The only logged error from vixie-cron:
Aug 20 19:01:01 tux cron[9304]: (arguseyes) ENTRYPOINT FAILED
(crontabs/arguseyes)
The avc.log:
Aug 20 19:00:32 tux type=1400 audit(1219284032.151:2574): avc: denied { read
} for pid=28854
comm="crontab" name="arguseyes" dev=dm-3 ino=1261578
scontext=unconfined_u:unconfined_r:unconfined_crontab_t
tcontext=unconfined_u:object_r:user_cron_spool_t
tclass=file
Aug 20 19:00:32 tux type=1400 audit(1219284032.151:2575): avc: denied {
getattr } for pid=28854
comm="crontab" path="/var/spool/cron/crontabs/arguseyes" dev=dm-3 ino=1261578
scontext=unconfined_u:unconfined_r:unconfined_crontab_t
tcontext=unconfined_u:object_r:user_cron_spool_t
tclass=file
Aug 20 19:00:45 tux type=1400 audit(1219284045.115:2576): avc: denied {
unlink } for pid=28854
comm="crontab" name="arguseyes" dev=dm-3 ino=1261578
scontext=unconfined_u:unconfined_r:unconfined_crontab_t
tcontext=unconfined_u:object_r:user_cron_spool_t
tclass=file
The actual context of the user crontab (/var/spool/cron/crontab/arguseyes)
unconfined_u:object_r:unconfined_cron_spool_t
I user ID from id -Z:
unconfined_u:unconfined_r:unconfined_t
Hope this helps.
----------------------------------------
> Subject: Re: [gentoo-hardened] SELinux: ENTRYPOINT FAILED for vixie-cron
> using policy modules 20080525
> From: [EMAIL PROTECTED]
> To: [email protected]
> Date: Mon, 18 Aug 2008 09:10:56 -0400
>
> On Sun, 2008-08-17 at 17:58 -0400, Randy Tupas wrote:
>> I am using selinux on a gentoo desktop, targeted policy (version 22)
>> with unstable policy modules 20080525. Policycoreutils ebuild version
>> 1.34.15.
>>
>> Since "upgrading", I have been receiving "ENTRYPOINT FAILED" from
>> vixie-cron.
>>
>> Re-emerging vixie-cron does not resolve the problem.
>>
>> Changing the type-context of "/var/spool/cron/crontab/username" from
>> "unconfined_cron_spool_t" to "user_cron_spool_t" allows vixie-cron to
>> run the crontab. The same applies to root crontabs by changing
>> "unconfined_cron_spool_t" to "sysadm_cron_spool_t".
>>
>> Unfortunately, I receive a lot of avc denials (below):
>>
>> Aug 17 14:30:01 tux type=1400 audit(1219008601.354:1507): avc: denied
>> { read } for pid=23035 comm="sh" name="reports" dev=dm-1 ino=360670
>> scontext=user_u:user_r:user_crond_t
>> tcontext=unconfined_u:object_r:unconfined_home_t tclass=dir
>>
>> I didn't have this problem when the old default user was "user_u" or
>> "root", vice "unconfined_u".
>
> What are the full cron error messages?
>
> --
> Chris PeBenito
>
> Developer,
> Hardened Gentoo Linux
>
> Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
> Key fingerprint = B0E6 877A 883F A57A 8E6A CB00 BC8E E42D E6AF 9243
_________________________________________________________________
Talk to your Yahoo! Friends via Windows Live Messenger. Find out how.
http://www.windowslive.com/explore/messenger?ocid=TXT_TAGLM_WL_messenger_yahoo_082008
