On Wed, 2008-08-20 at 22:06 -0400, Randy Tupas wrote:
> The only logged error from vixie-cron:
> Aug 20 19:01:01 tux cron[9304]: (arguseyes) ENTRYPOINT FAILED
> (crontabs/arguseyes)
>
> The avc.log:
> Aug 20 19:00:32 tux type=1400 audit(1219284032.151:2574): avc: denied {
> read } for pid=28854
> comm="crontab" name="arguseyes" dev=dm-3 ino=1261578
> scontext=unconfined_u:unconfined_r:unconfined_crontab_t
> tcontext=unconfined_u:object_r:user_cron_spool_t
> tclass=file
> Aug 20 19:00:32 tux type=1400 audit(1219284032.151:2575): avc: denied {
> getattr } for pid=28854
> comm="crontab" path="/var/spool/cron/crontabs/arguseyes" dev=dm-3 ino=1261578
> scontext=unconfined_u:unconfined_r:unconfined_crontab_t
> tcontext=unconfined_u:object_r:user_cron_spool_t
> tclass=file
> Aug 20 19:00:45 tux type=1400 audit(1219284045.115:2576): avc: denied {
> unlink } for pid=28854
> comm="crontab" name="arguseyes" dev=dm-3 ino=1261578
> scontext=unconfined_u:unconfined_r:unconfined_crontab_t
> tcontext=unconfined_u:object_r:user_cron_spool_t
> tclass=file
>
> The actual context of the user crontab (/var/spool/cron/crontab/arguseyes)
> unconfined_u:object_r:unconfined_cron_spool_t
>
> I user ID from id -Z:
> unconfined_u:unconfined_r:unconfined_tLooks like the vixie-cron patch needs to be updated to use getseuserbyname(), which is the function which handles user login mappings (the ones set by "semanage login"). > Hope this helps. > ---------------------------------------- > > Subject: Re: [gentoo-hardened] SELinux: ENTRYPOINT FAILED for vixie-cron > > using policy modules 20080525 > > From: [EMAIL PROTECTED] > > To: [email protected] > > Date: Mon, 18 Aug 2008 09:10:56 -0400 > > > > On Sun, 2008-08-17 at 17:58 -0400, Randy Tupas wrote: > >> I am using selinux on a gentoo desktop, targeted policy (version 22) > >> with unstable policy modules 20080525. Policycoreutils ebuild version > >> 1.34.15. > >> > >> Since "upgrading", I have been receiving "ENTRYPOINT FAILED" from > >> vixie-cron. > >> > >> Re-emerging vixie-cron does not resolve the problem. > >> > >> Changing the type-context of "/var/spool/cron/crontab/username" from > >> "unconfined_cron_spool_t" to "user_cron_spool_t" allows vixie-cron to > >> run the crontab. The same applies to root crontabs by changing > >> "unconfined_cron_spool_t" to "sysadm_cron_spool_t". > >> > >> Unfortunately, I receive a lot of avc denials (below): > >> > >> Aug 17 14:30:01 tux type=1400 audit(1219008601.354:1507): avc: denied > >> { read } for pid=23035 comm="sh" name="reports" dev=dm-1 ino=360670 > >> scontext=user_u:user_r:user_crond_t > >> tcontext=unconfined_u:object_r:unconfined_home_t tclass=dir > >> > >> I didn't have this problem when the old default user was "user_u" or > >> "root", vice "unconfined_u". > > > > What are the full cron error messages? -- Chris PeBenito <[EMAIL PROTECTED]> Developer, Hardened Gentoo Linux Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243 Key fingerprint = B0E6 877A 883F A57A 8E6A CB00 BC8E E42D E6AF 9243
signature.asc
Description: This is a digitally signed message part
