Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Running the latest version of FreeIPA servers install program fails with numerous AVCs Version-Release number of selected component (if applicable): How reproducible: Steps to Reproduce: 1. install freeipa-server 2. ipa-server-install -U -r NOVALOCAL -p freeipa4all -a freeipa4all --setup-dns --forwarder 192.168.0.3 Actual results: ipa : CRITICAL failed to create ds instance Command '/usr/sbin/setup-ds.pl --silent --logfile - -f /tmp/tmpgJewav' returned non-zero exit status 1 Expected results: Additional info: Running audit2allow shows allow dirsrv_t var_t:lnk_file read; Adding that as a policy module allows the install to get further, with the additional audit2allow rules generated. Complete output is #============= dirsrv_t ============== #!!!! This avc is allowed in the current policy allow dirsrv_t var_t:lnk_file read; #============= pki_tomcat_t ============== allow pki_tomcat_t rpm_script_tmp_t:dir { read write }; allow pki_tomcat_t var_t:lnk_file read; #============= systemd_tmpfiles_t ============== allow systemd_tmpfiles_t var_t:lnk_file read; It looks like dir srv is getting denied trying to read /var/locl, which is a symlink to /var/run/lock.
A little more data: I tried to do the same thing again on a clean F18 install, and got: [root@f18-base-ipa ~]# audit2allow -a -M pki ******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i pki.pp [root@f18-base-ipa ~]# semodule -i pki.pp libsepol.print_missing_requirements: ipa_dogtag's global requirements were not met: type/attribute pki_tomcat_t (No such file or directory). libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory). semodule: Failed!
Name pki something other then pki. You command is replacing the system pki.pp with your own. Try audit2allow -a -M mypki Looking at the AVC's you are showing. I think /var/run is mislabeled. restorecon /var/run Then the rpm_script_tmp_t dir looks like a leaked file descriptor.