Bug 959953 - ns-slapd won't start with SELinux in enforcing mode
Summary: ns-slapd won't start with SELinux in enforcing mode
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: 389-ds-base
Version: 19
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Rich Megginson
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-05-06 09:52 UTC by Tomasz Torcz
Modified: 2013-08-27 14:43 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-08-27 14:43:12 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description Tomasz Torcz 2013-05-06 09:52:56 UTC 
Description of problem:
ns-slapd won't start; the log file shows:

[06/May/2013:11:36:54 +0200] - Error - Unable to create /var/lock/dirsrv/slapd-PIPEBREAKER-PL/imports, Netscape Portable Runtime error -5966 (Access Denied.)

The cause is this AVC:
type=AVC msg=audit(1367833098.532:4744): avc:  denied  { create } for  pid=10477 comm="ns-slapd" name="imports" scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:var_lock_t:s0 tclass=dir

It works when switching to Permissive mode.

Version-Release number of selected component (if applicable):
389-ds-base-1.3.1.0-1.fc19.x86_64
selinux-policy-targeted-3.12.1-40.fc19.noarch
Comment 2 Orion Poplawski 2013-08-23 20:23:48 UTC 
Tomasz - Are you still seeing this?  I'm having a problem with dirsrv on F19 as well, but I'm not seeing this error.
Comment 3 Tomasz Torcz 2013-08-27 09:04:23 UTC 
Hm, not anymore, no. 389-ds-base-1.3.1.6-1.fc19.x86_64 starts fine in enforcing mode.

There is some problem with tmpfiles creation, but I haven't investigated it yet ("systemd-tmpfiles --create /etc/tmpfiles.d/dirsrv-PIPEBREAKER-PL.conf" fixes it, although it should happen automatically during boot).
Comment 4 Orion Poplawski 2013-08-27 14:43:12 UTC 
The tmpfiles issue is bug 996716
Note You need to log in before you can comment on or make changes to this bug.