Charlie Derwent wrote:
Sounds sort of related to the bug you mentioned in your release notes
but this was a clean install not an upgrade.

It looks like we need to update the minimum version of selinux-policy required. I believe this was fixed in 3.9.16-29 and it looks like you are running -24.






SELinux is preventing /usr/sbin/ns-slapd from read access on the
lnk_file /var/lock.

*****  Plugin restorecon (94.8 confidence) suggests

If you want to fix the label.
/var/lock default label should be var_lock_t.
Then you can run restorecon.
# /sbin/restorecon -v /var/lock

*****  Plugin catchall_labels (5.21 confidence) suggests

If you want to allow ns-slapd to have read access on the lock lnk_file
Then you need to change the label on /var/lock
# semanage fcontext -a -t FILE_TYPE '/var/lock'
where FILE_TYPE is one of the following: abrt_t, lib_t, root_t,
device_t, ld_so_t, proc_t, textrel_shlib_t, rpm_script_tmp_t, dirsrv_t,
var_lock_t, cert_t, usr_t, device_t, devlog_t, var_run_t, locale_t,
etc_t, proc_t, dirsrv_config_t, var_run_t, var_run_t.
Then execute:
restorecon -v '/var/lock'

*****  Plugin catchall (1.44 confidence) suggests

If you believe that ns-slapd should be allowed read access on the lock
lnk_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# grep ns-slapd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:dirsrv_t:s0
Target Context                system_u:object_r:var_t:s0
Target Objects                /var/lock [ lnk_file ]
Source                        ns-slapd
Source Path                   /usr/sbin/ns-slapd
Port <Unknown>
Host <>
Source RPM Packages           389-ds-base-1.2.10-0.4.a4.fc15
Target RPM Packages           filesystem-2.4.41-1.fc15
Policy RPM                    selinux-policy-3.9.16-24.fc15
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name <>
Platform                      Linux <> #1 SMP
                               Sun May 15 17:23:28 UTC 2011 x86_64 x86_64
Alert Count                   3
First Seen                    Fri 21 Oct 2011 01:28:21 AM BST
Last Seen                     Fri 21 Oct 2011 07:29:38 AM BST
Local ID

Raw Audit Messages
type=AVC msg=audit(1319178578.723:176): avc:  denied  { read } for
pid=26931 comm="ns-slapd" name="lock" dev=dm-1 ino=1281
tcontext=system_u:object_r:var_t:s0 tclass=lnk_file

type=SYSCALL msg=audit(1319178578.723:176): arch=x86_64 syscall=open
success=no exit=EACCES a0=7fff9b184460 a1=c2 a2=1a4 a3=0 items=0 ppid=1
pid=26931 auid=500 uid=492 gid=490 euid=492 suid=492 fsuid=492 egid=490
sgid=490 fsgid=490 tty=(none) ses=4 comm=ns-slapd exe=/usr/sbin/ns-slapd
subj=unconfined_u:system_r:dirsrv_t:s0 key=(null)

Hash: ns-slapd,dirsrv_t,var_t,lnk_file,read


#============= dirsrv_t ==============
allow dirsrv_t var_t:lnk_file read;

audit2allow -R

#============= dirsrv_t ==============
allow dirsrv_t var_t:lnk_file read;

Freeipa-users mailing list

Freeipa-users mailing list

Reply via email to