Hello,
I am running into problem with krb5kdc and SELinux. Version
information:
selinux-policy-targeted-1.25.3-12
kernel-2.6.12-1.1398_FC4
krb5-server-1.4.1-5
I was working with SELinux targeted and enforcing but I was having
problems with kadmin so I decided to disable SELinux
using /etc/sysconfig/selinux and reboot. This solved my kadmin problem
so I decided to re-enable SELinux so that I could capture traces to
raise a bug.
When I rebooted with SELinux enabled krb5kdc failed to start and I had
the following in /var/log/audit/audit.log:
type=AVC msg=audit(1125672380.961:124865): avc: denied { getattr } for pid=1836 comm="krb5kdc" name="krb5kdc_rcache" dev=dm-0 ino=552323 scontext=root:system_r:krb5kdc_t tcontext=system_u:object_r:file_t tclass=file
type=SYSCALL msg=audit(1125672380.961:124865): arch=40000003 syscall=195 success=no exit=-13 a0=90a3af0 a1=bff5d968 a2=3a4ff4 a3=0 items=1 pid=1836 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 comm="krb5kdc" exe="/usr/kerberos/sbin/krb5kdc"
type=AVC_PATH msg=audit(1125672380.961:124865): path="/var/tmp/krb5kdc_rcache"
type=CWD msg=audit(1125672380.961:124865): cwd="/"
type=PATH msg=audit(1125672380.961:124865): item=0 name="/var/tmp/krb5kdc_rcache" flags=1 inode=552323 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00
and in the log /var/log/krb5kdc.log:
krb5kdc: Permission denied in replay cache code - while initializing KDC
replay cache 'dfl:krb5kdc_rcache'
Is this a known issue, or should I Bugzilla it?
Thanks,
Keith.
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/fedora-selinux-list
