Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: It appears that the targeted policy doesn't provide a way to use a program target with syslog-ng. The policy won't allow syslogd_t to run /bin/bash so it doesn't matter how the destination program is actually labeled. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.12.1-69 syslog-ng-3.4.1-1 How reproducible: every time Steps to Reproduce: 1. install syslog-ng and change the configuation file to use a program destination, for example in syslog-ng.conf: destination d_auth { program("/usr/local/bin/foo.pl");}; At this point, the target program can be pretty much anything, because we're going to get denied no matter what. 2. start syslog-ng Actual results: A denial such as type=AVC msg=audit(1376057129.316:180564): avc: denied { execute } for pid=19455 comm="syslog-ng" name="bash" dev="dm-0" ino=660608 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file Expected results: The program should be run, or at least there should be some sort of correct label for the program to make it run, but it appears the targeted policy is denying it before it can even get that far.
If you run this in permissive mode what other AVC's do you get?
With permissive, I get: type=AVC msg=audit(1376485299.850:97310): avc: denied { execute } for pid=522 comm="syslog-ng" name="bash" dev="dm-0" ino=660608 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file type=AVC msg=audit(1376485299.850:97310): avc: denied { execute_no_trans } for pid=522 comm="syslog-ng" path="/usr/bin/bash" dev="dm-0" ino=660608 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file type=AVC msg=audit(1376485299.852:97311): avc: denied { execute } for pid=522 comm="sh" name="foo.pl" dev="dm-0" ino=671398 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:shell_exec_t:s0 tclass=file type=AVC msg=audit(1376485299.852:97311): avc: denied { execute_no_trans } for pid=522 comm="sh" path="/usr/local/bin/foo.pl" dev="dm-0" ino=671398 scontext=system_u:system_r:syslogd_t:s0 tcontext=unconfined_u:object_r:shell_exec_t:s0 tclass=file type=AVC msg=audit(1376485299.852:97311): avc: denied { execute } for pid=522 comm="sh" name="perl" dev="dm-0" ino=662275 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file
d30eb6c37953c7543d3878256a285e735862866e fixes this in git, you can add a custom policy module for now.
selinux-policy-3.12.1-71.fc19 has been submitted as an update for Fedora 19. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-71.fc19
Package selinux-policy-3.12.1-71.fc19: * should fix your issue, * was pushed to the Fedora 19 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-71.fc19' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-15088/selinux-policy-3.12.1-71.fc19 then log in and leave karma (feedback).
selinux-policy-3.12.1-71.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.