Hi list,
As many of you know I am working on a Managing Confined Services guide
for Fedora.
Having set up a simple squid environment on Fedora 11, with minimal
and default settings in squid.conf (http_port 3128 as allowed by
semanage, and a default cache_dir), I was able to create the cache
directory structure, but I got a denial when actually starting squid for
the first time (I assume this happens as it attempts to create its pid
in /var/run):
--
SELinux is preventing squid (squid_t) "read" var_run_t.
node=localhost.localdomain type=AVC msg=audit(1244690560.923:31): avc:
denied { read } for pid=2413 comm="squid" name="squid.pid" dev=dm-0
ino=364 scontext=unconfined_u:system_r:squid_t:s0
tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
node=localhost.localdomain type=SYSCALL msg=audit(1244690560.923:31):
arch=40000003 syscall=5 success=no exit=-13 a0=b7ec8340 a1=8000 a2=1b6
a3=0 items=0 ppid=2404 pid=2413 auid=500 uid=23 gid=23 euid=0 suid=0
fsuid=0 egid=23 sgid=23 fsgid=23 tty=pts0 ses=1 comm="squid"
exe="/usr/sbin/squid" subj=unconfined_u:system_r:squid_t:s0 key=(null)
--
I followed the FAQ as was linked in the denial text:
http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385
Using audit2allow, which gave me a type enforcement file, the contents
of which are:
--
module local 1.0;
require {
type var_run_t;
type squid_t;
class file read;
}
#============= squid_t ==============
allow squid_t var_run_t:file read;
--
and after creating and injecting a module from this as described in
that FAQ entry, I am now able to start squid and get it working fine.
Should this be filed as a bug? Is there a better way to fix it? I
figured it was worth mentioning as this happened out-of-the-box on F11
with default settings.
I am happy to provide any further details or output should you require
it.
selinux 3.6.12-39.fc11
linux 2.6.29.4-167.fc11
squid 3.0.STABLE13-1.fc11
Thanks,
--
Scott Radvan
Content Author, Platform (Installation and Deployment)
Red Hat Asia Pacific (Brisbane) http://www.apac.redhat.com
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
