Added to selinux-policy-3.11.1-74.fc18.noarch

selinux-policy-3.11.1-74.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-74.fc18

Stock unbound won't start with SELinux enabled

Package: (null)
OS Release: Fedora release 18 (Spherical Cow)

Did you try it with the latest policy?

Package selinux-policy-3.11.1-74.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-74.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-1693/selinux-policy-3.11.1-74.fc18
then log in and leave karma (feedback).

Sure! unbound now starts, but SELinux alerts are still thrown.
Fully reproducible on a fresh (and up-to-date) F18 x86_64 VM:

% sudo yum update
% sudo yum install unbound
% sudo systemctl start unbound.service
% sudo sealert -a

SELinux is preventing /usr/sbin/unbound-anchor from write access on the directory unbound.

*****  Plugin catchall (100. confidence) suggests  ***************************

If vous pensez que unbound-anchor devrait être autorisé à accéder write sur unbound directory par défaut.
Then vous devriez rapporter ceci en tant qu'anomalie.
Vous pouvez générer un module de stratégie local pour autoriser cet accès.
Do
autoriser cet accès pour le moment en exécutant :
# grep unbound-anchor /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:named_t:s0
Target Context                system_u:object_r:named_conf_t:s0
Target Objects                unbound [ dir ]
Source                        unbound-anchor
Source Path                   /usr/sbin/unbound-anchor
Port                          <Unknown>
Host                          seb-f18
Source RPM Packages           unbound-libs-1.4.19-1.fc18.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.11.1-74.fc18.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     seb-f18
Platform                      Linux seb-f18 3.7.4-204.fc18.x86_64 #1 SMP Wed Jan
                              23 16:44:29 UTC 2013 x86_64 x86_64
Alert Count                   2
First Seen                    2013-02-01 10:16:09 CET
Last Seen                     2013-02-01 17:47:34 CET
Local ID                      d9e0fa35-04b9-46e3-a603-3fce127a25be

Raw Audit Messages
type=AVC msg=audit(1359737254.148:850): avc:  denied  { write } for  pid=29252 comm="unbound-anchor" name="unbound" dev="dm-1" ino=413546 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:named_conf_t:s0 tclass=dir


type=SYSCALL msg=audit(1359737254.148:850): arch=x86_64 syscall=open success=no exit=EACCES a0=7fff13e5b020 a1=241 a2=1b6 a3=238 items=0 ppid=1 pid=29252 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=unbound-anchor exe=/usr/sbin/unbound-anchor subj=system_u:system_r:named_t:s0 key=(null)

Hash: unbound-anchor,named_t,named_conf_t,dir,write

audit2allow

#============= named_t ==============
#!!!! The source type 'named_t' can write to a 'dir' of the following types:
# named_log_t, var_run_t, named_tmp_t, krb5_host_rcache_t, tmp_t, named_cache_t, var_log_t, named_var_run_t

allow named_t named_conf_t:dir write;

audit2allow -R

#============= named_t ==============
#!!!! The source type 'named_t' can write to a 'dir' of the following types:
# named_log_t, var_run_t, named_tmp_t, krb5_host_rcache_t, tmp_t, named_cache_t, var_log_t, named_var_run_t

allow named_t named_conf_t:dir write;

For reference, the following, audit2allow-generated policy (after numerous passes!) allows unbound to start smoothly:

module unbound 1.0;

require {
	type named_conf_t;
	type named_t;
	class dir { write remove_name add_name };
	class file { write rename create unlink };
	class capability2 block_suspend;
}

#============= named_t ==============
allow named_t named_conf_t:dir { write remove_name add_name };
allow named_t named_conf_t:file unlink;
allow named_t named_conf_t:file { write rename create };
allow named_t self:capability2 block_suspend;

#============= named_t ==============
allow named_t named_conf_t:dir { write remove_name add_name };
allow named_t named_conf_t:file unlink;
allow named_t named_conf_t:file { write rename create };

these should be fixed in the unbound.

I see

# rpm -q selinux-policy
selinux-policy-3.11.1-74.fc18.noarch

# sesearch -A -s named_t -t named_t -c capability2
Found 1 semantic av rules:
   allow named_t named_t : capability2 block_suspend 


Could you try to reinstall selinux-policy-targeted?

Dear Miroslav,

The policy was against selinux-policy-3.11.1-73.fc18.noarch.

Only:
  allow named_t named_conf_t:dir { write remove_name add_name };
  allow named_t named_conf_t:file unlink;
  allow named_t named_conf_t:file { write rename create };

are required after applying selinux-policy-3.11.1-74.fc18.noarch.


Best regards,
Sébastien

This alert happens once each time I boot the machine.

Package: (null)
OS Release: Fedora release 18 (Spherical Cow)

Yes, these are not fixed. They should be fixed in the unbound.
 
Please add a local policy with these rules for now. Thank you.

selinux-policy-3.11.1-74.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.