Your message dated Sat, 16 Jun 2012 00:11:17 +1000
with message-id <[email protected]>
and subject line sorry, not a bug
has caused the Debian Bug report #642107,
regarding selinux-policy-default: SELinux prevents execution of psql
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
642107: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=642107
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: selinux-policy-default
Version: 2:0.2.20100524-7+squeeze1
Severity: normal
When using SELinux in enforcing mode (default policy, Debian Squeeze),
the command-line client psql cannot start:
# psql "service=debian"
Error: You must install at least one postgresql-client-<version> package.
# dpkg -l postgresql-client-\* |grep ii
ii postgresql-client-8.4 8.4.8-0squeeze1 front-end programs
for PostgreSQL 8.4
ii postgresql-client-common 113 manager for multiple PostgreSQL
client versions
What is strange is that no error or avc denied message, nothing in
auditd.log.
Running the command with strace shows that the execution of the real
psql binary fails:
9666 stat("/usr/lib/postgresql/8.4/bin/psql", 0x605130) = -1 EACCES
(Permission denied)
Context of use is root (staff_u:staff_r:staff_t:s0-s0:c0.c1023).
Files in /usr/lib/postgresql and /usr/share/postgresql are labeled
correctly (restorecon does not change anything).
Maybe this is caused by the wrapper ? psql is a symbolic link to
/usr/share/postgresql-common/pg_wrapper which does not have any specific
label.
# ls -alZ /usr/share/postgresql-common/pg_wrapper
-rwxr-xr-x. 1 root root system_u:object_r:usr_t:s0 6053 Aug 5 2010
/usr/share/postgresql-common/pg_wrapper
Pierre
-- System Information:
Debian Release: 6.0.2
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-5-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages selinux-policy-default depends on:
ii libpam-modules 1.1.1-6.1 Pluggable Authentication Modules f
ii libselinux1 2.0.96-1 SELinux runtime shared libraries
ii libsepol1 2.0.41-1 SELinux library for manipulating b
ii policycoreutils 2.0.82-3 SELinux core policy utilities
ii python 2.6.6-3+squeeze6 interactive high-level object-orie
Versions of packages selinux-policy-default recommends:
ii checkpolicy 2.0.22-1 SELinux policy compiler
pn setools <none> (no description available)
Versions of packages selinux-policy-default suggests:
pn logcheck <none> (no description available)
pn syslog-summary <none> (no description available)
-- Configuration Files:
/etc/selinux/default/modules/active/file_contexts.local [Errno 13] Permission
denied: u'/etc/selinux/default/modules/active/file_contexts.local'
-- no debconf information
--- End Message ---
--- Begin Message ---
At this time staff_t isn't a domain for starting daemons in the default
configuration. Your options are to write your own policy to do this (start
with a domain_auto_trans(staff_t, whatever_exec_t, whatever_t) ) or use
sysadm_t or unconfined_t to start daemons.
--
My Main Blog http://etbe.coker.com.au/
My Documents Blog http://doc.coker.com.au/
--- End Message ---
