Daniel J Walsh wrote:
...
>>>> Jan 23 07:12:41 pc setroubleshoot: SELinux is preventing /usr/sbin/chronyd from module_request access on the system . For complete SELinux messages. run sealert -l b7fea8ae-73b7-4588-aac7-36d4d5b69281
> No idea why this is starting up, but could you attach the output of.
>
> sealert -l b7fea8ae-73b7-4588-aac7-36d4d5b69281
In meantime this PC was rebooted and maybe therefore this alert isn't
found yet, it gives output:
query_alerts error (1003): id (b7fea8ae-73b7-4588-aac7-36d4d5b69281) not found
But perhaps same and newer alert:
sealert -l 268e2d9b-d891-47d5-8b44-07e0678871a8
SELinux is preventing /usr/sbin/chronyd from module_request access on the system .
***** Plugin disable_ipv6 (91.4 confidence) suggests ***********************
If you want to disable IPV6 on this machine
Then you need to set /proc/sys/net/ipv6/conf/all/disable_ipv6 to 1 and do not blacklist the module'
Do add
net.ipv6.conf.all.disable_ipv6 = 1
to /etc/sysctl.conf
***** Plugin catchall (9.59 confidence) suggests ***************************
If you believe that chronyd should be allowed module_request access on the system by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep chronyd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:chronyd_t:s0
Target Context system_u:system_r:kernel_t:s0
Target Objects [ system ]
Source chronyd
Source Path /usr/sbin/chronyd
Port <Neznámé>
Host pc.my.home
Source RPM Packages chrony-1.27-0.3.pre1.fc17.i686
Target RPM Packages
Policy RPM selinux-policy-3.10.0-166.fc17.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name pc.my.home
Platform Linux pc.my.home 3.6.11-5.fc17.i686.PAE #1
SMP Tue Jan 8 21:49:19 UTC 2013 i686 i686
Alert Count 2
First Seen 2013-01-24 11:49:10 CET
Last Seen 2013-01-24 11:49:39 CET
Local ID 268e2d9b-d891-47d5-8b44-07e0678871a8
Raw Audit Messages
type=AVC msg=audit(1359024579.623:91): avc: denied { module_request } for pid=753 comm="chronyd" kmod="net-pf-10" scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system
type=SYSCALL msg=audit(1359024579.623:91): arch=i386 syscall=socketcall success=no exit=EAFNOSUPPORT a0=1 a1=bf9065a0 a2=b76bbff4 a3=bf906694 items=0 ppid=1 pid=753 auid=4294967295 uid=983 gid=979 euid=983 suid=983 fsuid=983 egid=979
sgid=979 fsgid=979 tty=(none) ses=4294967295 comm=chronyd exe=/usr/sbin/chronyd subj=system_u:system_r:chronyd_t:s0 key=(null)
Hash: chronyd,chronyd_t,kernel_t,system,module_request
audit2allow
#============= chronyd_t ==============
#!!!! This avc can be allowed using the boolean 'domain_kernel_load_modules'
allow chronyd_t kernel_t:system module_request;
audit2allow -R
#============= chronyd_t ==============
#!!!! This avc can be allowed using the boolean 'domain_kernel_load_modules'
allow chronyd_t kernel_t:system module_request;
~~~~~~~~~
But sealert reccomendation isn't useful in this case, as I've IPv6 disabled
at kernel commandline (ipv6.disable=1) and directory /proc/sys/net/ipv6/
does not exist. Is there any better solution? (I maybe could disable SELinux
as this PC is in internal LAN and SELinux is even in permissive mode. But
I'm still in hope that someday will understand it this ;)
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
