I'm not having any luck with this package:
/var/log/message
Apr 11 14:56:39 fc6work racoon: ERROR: no configuration found for
127.0.0.1.
Apr 11 14:56:39 fc6work racoon: ERROR: failed to begin ipsec sa
negotication.
Apr 11 14:57:09 fc6work racoon: INFO: security context doi: 1
Apr 11 14:57:09 fc6work racoon: INFO: security context algorithm: 1
Apr 11 14:57:09 fc6work racoon: INFO: security context length: 44
Apr 11 14:57:09 fc6work racoon: INFO: security context:
system_u:system_r:jcdx_ep_t:s0-s15:c0.c1023
Apr 11 14:57:09 fc6work racoon: ERROR: no configuration found for
127.0.0.1.
Apr 11 14:57:09 fc6work racoon: ERROR: failed to begin ipsec sa
negotication.
Apr 11 14:57:39 fc6work racoon: INFO: security context doi: 1
Apr 11 14:57:39 fc6work racoon: INFO: security context algorithm: 1
Apr 11 14:57:39 fc6work racoon: INFO: security context length: 43
setkey -DP
...
127.0.0.1[any] 127.0.0.1[any] any
in prio def ipsec
esp/transport//require
created: Apr 11 09:46:32 2007 lastused:
lifetime: 0(s) validtime: 0(s)
security context doi: 1
security context algorithm: 1
security context length: 46
security context: system_u:object_r:ipsec_spd_t:s0-s15:c0.c1023
spid=8 seq=13 pid=3351
refcnt=1
10.211.55.6[any] 10.211.55.6[any] any
in prio def ipsec
esp/transport//require
created: Apr 11 09:46:32 2007 lastused:
lifetime: 0(s) validtime: 0(s)
security context doi: 1
security context algorithm: 1
security context length: 46
security context: system_u:object_r:ipsec_spd_t:s0-s15:c0.c1023
spid=32 seq=12 pid=3351
refcnt=1
127.0.0.1[any] 127.0.0.1[any] any
out prio def ipsec
esp/transport//require
created: Apr 11 09:46:32 2007 lastused: Apr 11 15:00:11 2007
lifetime: 0(s) validtime: 0(s)
security context doi: 1
security context algorithm: 1
security context length: 46
security context: system_u:object_r:ipsec_spd_t:s0-s15:c0.c1023
spid=1 seq=11 pid=3351
refcnt=41
10.211.55.6[any] 10.211.55.6[any] any
out prio def ipsec
esp/transport//require
created: Apr 11 09:46:32 2007 lastused: Apr 11 14:59:39 2007
lifetime: 0(s) validtime: 0(s)
security context doi: 1
security context algorithm: 1
security context length: 46
security context: system_u:object_r:ipsec_spd_t:s0-s15:c0.c1023
spid=25 seq=10 pid=3357
refcnt=3
127.0.0.1[any] 127.0.0.1[any] any
fwd prio def ipsec
esp/transport//require
created: Apr 11 09:46:32 2007 lastused:
lifetime: 0(s) validtime: 0(s)
security context doi: 1
security context algorithm: 1
security context length: 46
security context: system_u:object_r:ipsec_spd_t:s0-s15:c0.c1023
spid=18 seq=9 pid=3357
refcnt=1
10.211.55.6[any] 10.211.55.6[any] any
fwd prio def ipsec
esp/transport//require
created: Apr 11 09:46:32 2007 lastused:
lifetime: 0(s) validtime: 0(s)
security context doi: 1
security context algorithm: 1
security context length: 46
security context: system_u:object_r:ipsec_spd_t:s0-s15:c0.c1023
spid=42 seq=8 pid=3357
refcnt=1
/var/log/audit/audit.log has lots of polmatch avcs
type=AVC msg=audit(1176302177.663:28): avc: denied { polmatch }
for pid=2129 comm="cupsd"
scontext=system_u:system_r:cupsd_t:s15:c0.c1023
tcontext=system_u:object_r:ipsec_spd_t:s0-s15:c0.c1023
tclass=association
type=AVC msg=audit(1176302177.663:28): avc: denied { sendto } for
pid=2129 comm="cupsd" scontext=system_u:system_r:cupsd_t:s15:c0.c1023
tcontext=system_u:system_r:cupsd_t:s15:c0.c1023 tclass=association
type=SYSCALL msg=audit(1176302177.663:28): arch=40000003 syscall=102
success=no exit=-3 a0=3 a1=bfe48050 a2=2baff4 a3=2 items=0 ppid=2128
pid=2129 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) comm="cupsd" exe="/usr/sbin/cupsd"
subj=system_u:system_r:cupsd_t:s15:c0.c1023 key=(null)
I'm running a modified version of the 2.5.2 policy with xace changes
from Eamon Walsh. I'll try to build a box with current LSPP policy to
determine if it a policy issue.
joe
--
redhat-lspp mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/redhat-lspp
