>> # cat mylog
>> type=AVC msg=audit(1299774763.043:2272): avc: denied { getattr } for
>> pid=3245 comm="httpd" path="/etc/munin/htpasswd.users" dev=sda1
>> ino=3543833 scontext=system_u:system_r:httpd_t:s0
>> tcontext=system_u:object_r:munin_etc_t:s0 tclass=file
>> type=AVC msg=audit(1299777304.684:2366): avc: denied { write } for
>> pid=12066 comm="munin_stats" name="munin_stats-127.0.0.1" dev=sda1
>> ino=3676145 scontext=unconfined_u:system_r:munin_t:s0
>> tcontext=system_u:object_r:munin_plugin_state_t:s0 tclass=file
>>
>> # cat mylog | audit2allow -M mypol && semodule -i mypol.pp
>> ******************** IMPORTANT ***********************
>> To make this policy package active, execute:
>>
>> semodule -i mypol.pp
>>
>> And it has no effect..
>>
>>> I would suggest you collect all the information you can and open a bug
>>> report.
>>
>> Does this still sound like a bug or am I doing something wrong?
>>
>> Thanks,
>> A
> We would need to see the new AVC information.
Okay, now I'm not sure what's happened. I have these messages in the audit.log:
type=AVC msg=audit(1299782498.255:2552): avc: denied { search } for
pid=3245 comm="httpd" name="munin" dev=sda1 ino=3675604
scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:munin_etc_t:s0 tclass=dir
type=SYSCALL msg=audit(1299782498.255:2552): arch=c000003e syscall=2
success=no exit=-13 a0=7f2c812e4df8 a1=80000 a2=1b6 a3=33 items=0
ppid=1382 pid=3245 auid=4294967295 uid=48 gid=48 euid=48 suid=48
fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295
comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0
key=(null)
I notice this from syslog:
Mar 10 13:41:39 gary setroubleshoot: SELinux is preventing
/usr/sbin/httpd from search access on the directory /etc/munin. For
complete SELinux messages. run sealert -l
1d6377ba-f07e-4cd5-ac6c-0d0e68cda3c0
I followed the instructions, and now I'm able to login to view the
munin graphs after authenticating. However, I know I've done this at
least once before for the same access problem.
I just now found this in the audit.log:
type=AVC msg=audit(1299783004.601:2571): avc: denied { write } for
pid=21883 comm="munin_stats" name="munin_stats-127.0.0.1" dev=sda1
ino=3676145 scontext=unconfined_u:system_r:munin_t:s0
tcontext=system_u:object_r:munin_plugin_state_t:s0 tclass=file
However, I'm still able to login.
Thanks,
Alex
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
