I have not been able to solve this issue but was able to 'get around' it
via F8.
Below is the named.conf, just for the logging group:
=========================================
logging {
channel my_syslog { file "/var/log/named/named.log" versions 25;
severity info;
print-category yes;
print-time yes;
};
channel my_lame { file "/var/log/named/lame.log" versions 25;
severity info;
print-category yes;
print-time yes;
// size 50M;
};
channel my_xfer { file "/var/log/named/xfer.log" versions 25;
severity info;
print-category yes;
print-time yes;
// size 50M;
};
channel my_update { file "/var/log/named/named.update" versions 25;
severity info;
print-category yes;
print-time yes;
// size 50M;
};
channel my_db { file "/var/log/named/db.log" versions 25;
severity info;
print-category yes;
print-time yes;
// size 50M;
};
channel my_query { file "/var/log/named/query.log" versions 25;
severity info;
print-category yes;
print-time yes;
// size 50M;
};
channel my_security { file "/var/log/named/security.log" versions 99;
severity info;
print-category yes;
print-time yes;
// size 50M;
};
channel my_debug { file "/var/log/named/named.debug" versions 20;
severity dynamic;
print-category yes;
print-time yes;
// size 50M;
};
category security { my_security; };
category default { my_syslog; };
category queries { my_query; };
category lame-servers { my_lame; };
category update { my_update; };
// category db { my_db; };
category xfer-in { my_xfer; };
category xfer-out { my_xfer; };
// category packet { null; };
// category eventlib { my_syslog; };
};
=========================================
Please note that the pathname is chrooted and is actually
found in: /var/named/chroot/var/log/named and the files
are initially set there with proper context of named_log_t
and the directory permissions set with user named with
access and context set accordingly.
Below is the selinux complaint:
=========================================
From: /var/log/messages:
-------------------------------
Jul 9 18:43:27 bronze named[10903]: unable to rename log file
'/var/log/named/named.log' to '/var/log/named/named.log.0': permission
denied
Jul 9 18:43:27 bronze setroubleshoot: SELinux is preventing named
(named_t) "write" to ./named (named_conf_t). For complete SELinux
messages. run sealert -l ebd583dd-e96e-49ad-b6ce-72eda7273b09
# sealert -l ebd583dd-e96e-49ad-b6ce-72eda7273b09
=========================================
Summary:
SELinux is preventing named (named_t) "write" to ./named (named_conf_t).
Detailed Description:
SELinux denied access requested by named. It is not expected that this
access is
required by named and this access may signal an intrusion attempt. It is
also
possible that the specific version or configuration of the application is
causing it to require additional access.
Allowing Access:
Sometimes labeling problems can cause SELinux denials. You could try to
restore
the default system file context for ./named,
restorecon -v './named'
If this does not work, there is currently no automatic way to allow this
access.
Instead, you can generate a local policy module to allow this access -
see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can
disable
SELinux protection altogether. Disabling SELinux protection is not
recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.
Additional Information:
Source Context unconfined_u:system_r:named_t:s0
Target Context system_u:object_r:named_conf_t:s0
Target Objects ./named [ dir ]
Source named
Source Path /usr/sbin/named
Port <Unknown>
Host bronze.cdkkt.com
Source RPM Packages bind-9.5.0-32.rc1.fc9
Target RPM Packages
Policy RPM selinux-policy-3.3.1-74.fc9
Selinux Enabled True
Policy Type targeted
MLS Enabled True
Enforcing Mode Enforcing
Plugin Name catchall_file
Host Name bronze.cdkkt.com
Platform Linux bronze.cdkkt.com
2.6.25.9-76.fc9.i686 #1 SMP
Fri Jun 27 16:14:35 EDT 2008 i686 i686
Alert Count 1
First Seen Wed Jul 9 18:43:27 2008
Last Seen Wed Jul 9 18:43:27 2008
Local ID ebd583dd-e96e-49ad-b6ce-72eda7273b09
Line Numbers
Raw Audit Messages
host=bronze.cdkkt.com type=AVC msg=audit(1215654207.611:139): avc:
denied { write } for pid=10904 comm="named" name="named" dev=sda6
ino=2023442 scontext=unconfined_u:system_r:named_t:s0
tcontext=system_u:object_r:named_conf_t:s0 tclass=dir
host=bronze.cdkkt.com type=SYSCALL msg=audit(1215654207.611:139):
arch=40000003 syscall=38 success=no exit=-13 a0=b547a4e8 a1=b7ee488a
a2=4932fc a3=b7ee488a items=0 ppid=10902 pid=10904 auid=500 uid=25
gid=25 euid=25 suid=25 fsuid=25 egid=25 sgid=25 fsgid=25 tty=(none)
ses=2 comm="named" exe="/usr/sbin/named"
subj=unconfined_u:system_r:named_t:s0 key=(null)
=========================================
I have tried changing the context, permissions, restorecon and nothing
seemed to help.
Advice please?
Thanks!
Dan
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
