apcupsd

[grift]

On Tue, 2012-12-18 at 16:37 +0000, Moray Henderson wrote:
> Hi SELinux
> 
> 
> Trying to start apcupsd (version 3.14.10) configured for snmp on CentOS 6.3
> (targeted policy 3.7.19) results in 
> 
> ----
> time->Tue Dec 18 16:07:47 2012
> type=SYSCALL msg=audit(1355846867.862:18629): arch=c000003e syscall=49
> success=yes exit=0 a0=4 a1=7fffabaa61f0 a2=10 a3=7fffabaa5f30 items=0 ppid=1
> pid=2162 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> tty=(none) ses=2 comm="apcupsd" exe="/sbin/apcupsd"
> subj=unconfined_u:system_r:apcupsd_t:s0 key=(null)
> type=AVC msg=audit(1355846867.862:18629): avc:  denied  { node_bind } for
> pid=2162 comm="apcupsd" scontext=unconfined_u:system_r:apcupsd_t:s0
> tcontext=system_u:object_r:node_t:s0 tclass=udp_socket
> sls.test.office:~# ausearch -a 18629 -a 18630
> ----
> time->Tue Dec 18 16:07:47 2012
> type=SYSCALL msg=audit(1355846867.864:18630): arch=c000003e syscall=49
> success=yes exit=0 a0=5 a1=7fffabaa61f0 a2=10 a3=7fffabaa5f30 items=0 ppid=1
> pid=2162 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
> tty=(none) ses=2 comm="apcupsd" exe="/sbin/apcupsd"
> subj=unconfined_u:system_r:apcupsd_t:s0 key=(null)
> type=AVC msg=audit(1355846867.864:18630): avc:  denied  { net_bind_service }
> for  pid=2162 comm="apcupsd" capability=10
> scontext=unconfined_u:system_r:apcupsd_t:s0
> tcontext=unconfined_u:system_r:apcupsd_t:s0 tclass=capability
> type=AVC msg=audit(1355846867.864:18630): avc:  denied  { name_bind } for
> pid=2162 comm="apcupsd" src=162 scontext=unconfined_u:system_r:apcupsd_t:s0
> tcontext=system_u:object_r:snmp_port_t:s0 tclass=udp_socket
> 
> If SELinux is enforcing, apcupsd crashes.  If SELinux is permissive, it
> works.
> 
> apcupsd.conf contains
> 
> UPSCABLE ether
> UPSTYPE snmp
> DEVICE 192.168.1.1:161:APC:private
> 
> Is there a configuration, Boolean or a policy-writing macro to fix this
> easily?
> 
> 

mkdir myapcupsd; cd myapcupsd; echo "policy_module(myapcupsd, 1.0.0)
gen_require(\` type apcupsd_t; ')
corenet_udp_bind_generic_node(apcupsd_t)
corenet_udp_bind_snmp_port(apcupsd_t) allow apcupsd_t self:capability
net_bind_service;"  > myapcupsd.te

make -f /usr/share/selinux/devel/Makefile myapcupsd.te
sudo semodule -i myapcupsd.pp;

consider filing a bugzilla please

> 
> Moray.
> "To err is human; to purr, feline."
> 
> 
> 
> 
> 
> --
> selinux mailing list
> selinux at lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux