Fedora Account System
Red Hat Associate
Red Hat Customer
SELinux is preventing /usr/sbin/ns-slapd from write access on the sock_file /var/uuidd/request. ***** Plugin catchall_labels (83.8 confidence) suggests ******************** If you want to allow ns-slapd to have write access on the request sock_file Then you need to change the label on /var/uuidd/request Do # semanage fcontext -a -t FILE_TYPE '/var/uuidd/request' where FILE_TYPE is one of the following: abrt_var_run_t, avahi_var_run_t, devlog_t, dirsrv_var_lib_t, dirsrv_var_run_t, init_var_run_t, lsassd_var_socket_t, nscd_var_run_t, nslcd_var_run_t, pcscd_var_run_t, rpcbind_var_run_t, setrans_var_run_t, sssd_var_lib_t, system_dbusd_var_run_t, winbind_var_run_t. Then execute: restorecon -v '/var/uuidd/request' ***** Plugin catchall (17.1 confidence) suggests *************************** If you believe that ns-slapd should be allowed write access on the request sock_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep ns-slapd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:dirsrv_t:s0 Target Context system_u:object_r:var_t:s0 Target Objects /var/uuidd/request [ sock_file ] Source ns-slapd Source Path /usr/sbin/ns-slapd Port <Unknown> Host ipa Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.11.1-87.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name ipa Platform Linux ipa 3.8.6-203.fc18.i686.PAE #1 SMP Tue Apr 9 19:44:44 UTC 2013 i686 i686 Alert Count 1 First Seen 2013-04-15 11:40:55 CEST Last Seen 2013-04-15 11:40:55 CEST Local ID ccbb563e-b48d-4ef7-88e1-cadddfdb50b3 Raw Audit Messages type=AVC msg=audit(1366018855.69:1245): avc: denied { write } for pid=929 comm="ns-slapd" name="request" dev="dm-1" ino=524491 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=sock_file type=SYSCALL msg=audit(1366018855.69:1245): arch=i386 syscall=socketcall success=no exit=EACCES a0=3 a1=ab05adf0 a2=4ced2000 a3=0 items=0 ppid=1 pid=929 auid=4294967295 uid=995 gid=995 euid=995 suid=995 fsuid=995 egid=995 sgid=995 fsgid=995 ses=4294967295 tty=(none) comm=ns-slapd exe=2F7573722F7362696E2F6E732D736C617064202864656C6574656429 subj=system_u:system_r:dirsrv_t:s0 key=(null) Hash: ns-slapd,dirsrv_t,var_t,sock_file,write audit2allow #============= dirsrv_t ============== allow dirsrv_t var_t:sock_file write; audit2allow -R
Additional this one: SELinux is preventing /usr/sbin/ns-slapd (deleted) from search access on the directory /var/lib/libuuid. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that ns-slapd (deleted) should be allowed search access on the libuuid directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep ns-slapd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:dirsrv_t:s0 Target Context system_u:object_r:uuidd_var_lib_t:s0 Target Objects /var/lib/libuuid [ dir ] Source ns-slapd Source Path /usr/sbin/ns-slapd (deleted) Port <Unknown> Host ipa Source RPM Packages Target RPM Packages uuidd-2.22.2-6.fc18.i686 Policy RPM selinux-policy-3.11.1-87.fc18.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name ipa Platform Linux ipa 3.8.6-203.fc18.i686.PAE #1 SMP Tue Apr 9 19:44:44 UTC 2013 i686 i686 Alert Count 1 First Seen 2013-04-15 11:40:55 CEST Last Seen 2013-04-15 11:40:55 CEST Local ID 6346f643-7d5b-4203-a12c-795a3dd0b04d Raw Audit Messages type=AVC msg=audit(1366018855.77:1246): avc: denied { search } for pid=929 comm="ns-slapd" name="libuuid" dev="dm-1" ino=525685 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:uuidd_var_lib_t:s0 tclass=dir type=SYSCALL msg=audit(1366018855.77:1246): arch=i386 syscall=open success=no exit=EACCES a0=4cecfb28 a1=8042 a2=1b0 a3=0 items=0 ppid=1 pid=929 auid=4294967295 uid=995 gid=995 euid=995 suid=995 fsuid=995 egid=995 sgid=995 fsgid=995 ses=4294967295 tty=(none) comm=ns-slapd exe=2F7573722F7362696E2F6E732D736C617064202864656C6574656429 subj=system_u:system_r:dirsrv_t:s0 key=(null) Hash: ns-slapd,dirsrv_t,uuidd_var_lib_t,dir,search audit2allow #============= dirsrv_t ============== allow dirsrv_t uuidd_var_lib_t:dir search; audit2allow -R
would this be of any use (haven't tried this yet...) ? filecontext: /var/uuid(/.*)? system_u:object_r:uuidd_var_lib_t:s0 Module: module mypol 1.0; require { type dirsrv_t; type uuidd_var_lib_t; class sock_file write; class dir search; } #============= dirsrv_t ============== allow dirsrv_t uuidd_var_lib_t:dir search; allow dirsrv_t uuidd_var_lib_t:sock_file write;
The final policy I'm using here is: File context: /var/uuidd(/.*)? system_u:object_r:uuidd_var_lib_t:s0 Policy module: module net.guldbrand.ipa_ns-slapd_libuuid 1.0.2; require { type dirsrv_t; type uuidd_var_lib_t; type uuidd_t; class sock_file write; class unix_stream_socket connectto; class dir search; } #============= dirsrv_t ============== allow dirsrv_t uuidd_t:unix_stream_socket connectto; allow dirsrv_t uuidd_var_lib_t:dir search; allow dirsrv_t uuidd_var_lib_t:sock_file write;
Fixed in selinux-policy-3.11.1-91.fc18.noarch
selinux-policy-3.11.1-91.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/selinux-policy-3.11.1-91.fc18
Package selinux-policy-3.11.1-91.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.11.1-91.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-6018/selinux-policy-3.11.1-91.fc18 then log in and leave karma (feedback).
selinux-policy-3.11.1-91.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.