gss-proxy December 2024

gss-proxy@lists.fedorahosted.org

1 participants
1 discussions

[gssapi/gssproxy] 6874c5: Remove the NoNewPrivileges because it breaks the a...
by yixiangzhike 10 Dec '24

10 Dec '24

Branch: refs/heads/main Home: https://github.com/gssapi/gssproxy Commit: 6874c569ee743312cebff91e7146267f185f0332 https://github.com/gssapi/gssproxy/commit/6874c569ee743312cebff91e7146267f1… Author: yixiangzhike <yixiangzhike007(a)163.com> Date: 2024-12-10 (Tue, 10 Dec 2024) Changed paths: M systemd/gssproxy.service.in Log Message: ----------- Remove the NoNewPrivileges because it breaks the ability to open socket If NoNewPrivileges is true, it breaks the ability to open a socket under /var/lib/gssproxy when selinux enabled. The failed messages: Nov 30 11:37:33 localhost systemd[1]: Starting GSSAPI Proxy Daemon... Nov 30 11:37:34 localhost gssproxy[22445]: gssproxy[22445]: Failed to create Unix Socket! (13:Permission denied) Nov 30 11:37:34 localhost systemd[1]: gssproxy.service: Main process exited, code=exited, status=1/FAILURE Nov 30 11:37:34 localhost systemd[1]: gssproxy.service: Failed with result 'exit-code'. Nov 30 11:37:34 localhost systemd[1]: Failed to start GSSAPI Proxy Daemon. The audit log: type=SELINUX_ERR msg=audit(11/30/2024 11:37:34.067:189) : op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:init_t:s0 newcontext=system_u:system_r:gssproxy_t:s0 type=AVC msg=audit(11/30/2024 11:37:34.067:189) : avc: denied { nnp_transition } for pid=22445 comm=(gssproxy) scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:gssproxy_t:s0 tclass=process2 permissive=0 ---- type=AVC msg=audit(11/30/2024 11:37:34.080:190) : avc: denied { add_name } for pid=22445 comm=gssproxy name=default.sock scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:gssproxy_var_lib_t:s0 tclass=dir permissive=0 ---- type=SERVICE_START msg=audit(11/30/2024 11:37:34.082:191) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='unit=gssproxy comm=systemd exe=/usr/lib/systemd/systemd hostname=? addr=? terminal=? res=failed' Signed-off-by: yixiangzhike <yixiangzhike007(a)163.com> To unsubscribe from these emails, change your notification settings at https://github.com/gssapi/gssproxy/settings/notifications

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

gss-proxy December 2024