ntpd drift.TEMP file

I have just built an FC3 samba server using the K12LTSP iso's and am
getting the following messages on the log.

Jan 21 01:55:14 admin ntpd[9988]: can't open /etc/ntp/drift.TEMP:
Permission denied
Jan 21 01:55:14 admin kernel: audit(1106290514.375:0): avc:  denied  {
write } for  pid=9988 exe=/usr/sbin/ntpd name=ntp dev=hda3 ino=3392705
scontext=root:system_r:ntpd_t tcontext=system_u:object_r:etc_t tclass=dir

With SELinux enabled, the drift file could not be created.  In permissive
mode, the drift file is properly created and updated.  What have I done
wrong?

[root@admin ntp]# ls -dZ .
drwxr-xr-x  ntp      ntp      system_u:object_r:etc_t
 [root@admin ntp]# ls -lZ drift
-rw-r--r--  ntp      ntp      root:object_r:etc_t              drift

Mark Orenstein
East Granby, CT School System

[Tom London]

On Sun, 23 Jan 2005 14:30:30 -0500 (EST),
mroselinux(a)eastgranby.k12.ct.us <mroselinux(a)eastgranby.k12.ct.us&gt;
wrote:
>  I have just built an FC3 samba server using the K12LTSP iso's and
> am
>  getting the following messages on the log.
>  
>  Jan 21 01:55:14 admin ntpd[9988]: can't open /etc/ntp/drift.TEMP:
>  Permission denied
>  Jan 21 01:55:14 admin kernel: audit(1106290514.375:0): avc:  denied  {
>  write } for  pid=9988 exe=/usr/sbin/ntpd name=ntp dev=hda3 ino=3392705
>  scontext=root:system_r:ntpd_t tcontext=system_u:object_r:etc_t tclass=dir
>  
>  With SELinux enabled, the drift file could not be created.  In permissive
>  mode, the drift file is properly created and updated.  What have I done
>  wrong?
>  
>  [root@admin ntp]# ls -dZ .
>  drwxr-xr-x  ntp      ntp      system_u:object_r:etc_t
>   [root@admin ntp]# ls -lZ drift
>  -rw-r--r--  ntp      ntp      root:object_r:etc_t              drift
>   
version of ntp?  

Mine (ntp-4.2.0.a.20040617-6) places the drift file in /var/lib/ntp.
/var/lib/ntp seems appropriately labeled ntp_drift_t.

tom

-- 
Tom London

Thanks,

I had driftfile pointing to /etc/ntp and changing it to /var/lib/ntp fixed
it.  It's a file I've carried forward for at least four years.

Mark

>  On Sun, 23 Jan 2005 14:30:30 -0500 (EST),
>  mroselinux(a)eastgranby.k12.ct.us <mroselinux(a)eastgranby.k12.ct.us&gt;
>  wrote:
> > I have just built an FC3 samba server using the K12LTSP iso's and am
> > getting the following messages on the log.
> >
> > Jan 21 01:55:14 admin ntpd[9988]: can't open /etc/ntp/drift.TEMP:
> > Permission denied
> > Jan 21 01:55:14 admin kernel: audit(1106290514.375:0): avc:  denied  {
> > write } for  pid=9988 exe=/usr/sbin/ntpd name=ntp dev=hda3 ino=3392705
> > scontext=root:system_r:ntpd_t tcontext=system_u:object_r:etc_t
> > tclass=dir
> >
> > With SELinux enabled, the drift file could not be created.  In
> > permissive
> > mode, the drift file is properly created and updated.  What have I done
> > wrong?
> >
> > [root@admin ntp]# ls -dZ .
> > drwxr-xr-x  ntp      ntp      system_u:object_r:etc_t
> >  [root@admin ntp]# ls -lZ drift
> > -rw-r--r--  ntp      ntp      root:object_r:etc_t              drift
> >
>  version of ntp?
>
>  Mine (ntp-4.2.0.a.20040617-6) places the drift file in /var/lib/ntp.
>  /var/lib/ntp seems appropriately labeled ntp_drift_t.
>
>  tom
>
>  --
>  Tom London
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>

[Lars Gullik Bjønnes]

mroselinux(a)eastgranby.k12.ct.us writes:

| Thanks,
>  
| I had driftfile pointing to /etc/ntp and changing it to
/var/lib/ntp fixed
| it.  It's a file I've carried forward for at least four years.

You are sure you don't still get the same errors for drift.TEMP?

> > Mine (ntp-4.2.0.a.20040617-6) places the drift file in
> /var/lib/ntp.
> > /var/lib/ntp seems appropriately labeled ntp_drift_t. 
I have the drift file in /var/lib/ntp/drift, but I get selinux errors
for drift.TEMP:

Mar  6 18:51:26 slabber ntpd[26387]: can't open
/var/lib/ntp/drift.TEMP: Permission denied
Mar  6 18:51:26 slabber kernel: audit(1110131486.894:0): avc:  denied
{ dac_override } for  pid=26387 exe=/usr/sbin/ntpd capability=1
scontext=root:system_r:ntpd_t tcontext=root:system_r:ntpd_t
tclass=capability

This is an updated FC3 system.

-- 
	Lgb

[Chuck Anderson]

On Sun, Mar 06, 2005 at 07:03:26PM +0100, Lars Gullik Bjønnes wrote:
>  I have the drift file in /var/lib/ntp/drift, but I get selinux
> errors
>  for drift.TEMP:
>  
>  Mar  6 18:51:26 slabber ntpd[26387]: can't open
>  /var/lib/ntp/drift.TEMP: Permission denied
>  Mar  6 18:51:26 slabber kernel: audit(1110131486.894:0): avc:  denied
>  { dac_override } for  pid=26387 exe=/usr/sbin/ntpd capability=1
>  scontext=root:system_r:ntpd_t tcontext=root:system_r:ntpd_t
>  tclass=capability
>  
>  This is an updated FC3 system. 
What are the DAC unix permissions bits and owner/group on the file? I
am no expert in SELinux, but that AVC sounds to me like the standard
unix permissions are disallowing access to the file.

[Lars Gullik Bjønnes]

"Chuck R. Anderson" <cra(a)WPI.EDU&gt; writes:

| On Sun, Mar 06, 2005 at 07:03:26PM +0100, Lars Gullik Bjønnes wrote:
> > I have the drift file in /var/lib/ntp/drift, but I get selinux
> errors
> > for drift.TEMP:
> > 
> > Mar  6 18:51:26 slabber ntpd[26387]: can't open
> > /var/lib/ntp/drift.TEMP: Permission denied
> > Mar  6 18:51:26 slabber kernel: audit(1110131486.894:0): avc:  denied
> > { dac_override } for  pid=26387 exe=/usr/sbin/ntpd capability=1
> > scontext=root:system_r:ntpd_t tcontext=root:system_r:ntpd_t
> > tclass=capability
> > 
> > This is an updated FC3 system.
>  
| What are the DAC unix permissions bits and owner/group on the file?

Of the directory you mean? It is creating the file in the first place
that fails.

 ls -la /var/lib/ntp/
total 24
drwxr-xr-x   2 ntp  ntp  4096 Mar  6 22:20 .
drwxr-xr-x  14 root root 4096 Feb 22 17:38 ..
-rw-r--r--   1 ntp  ntp     7 Mar  6 22:20 drift

| I
| am no expert in SELinux, but that AVC sounds to me like the standard
| unix permissions are disallowing access to the file.

> From /etc/selinux/targeted/contexts/file_contexts it seems this should
be allowed. But I am not familiar with the format:

grep -nr drift *
files/file_contexts.pre:676:/var/lib/ntp(/.*)?
system_u:object_r:ntp_drift_t
files/file_contexts.pre:677:/etc/ntp/data(/.*)?
system_u:object_r:ntp_drift_t
files/file_contexts:676:/var/lib/ntp(/.*)?
system_u:object_r:ntp_drift_t
files/file_contexts:677:/etc/ntp/data(/.*)?
system_u:object_r:ntp_drift_t

-- 
	Lgb

[Colin Walters]

On Sun, 2005-03-06 at 22:45 +0100, Lars Gullik Bjønnes wrote:

> Of the directory you mean? It is creating the file in the first place
> that fails.
>
>  ls -la /var/lib/ntp/
> total 24
> drwxr-xr-x   2 ntp  ntp  4096 Mar  6 22:20 .
> drwxr-xr-x  14 root root 4096 Feb 22 17:38 ..
> -rw-r--r--   1 ntp  ntp     7 Mar  6 22:20 drift 
Do you have ntpd configured to run as root or something?

[Lars Gullik Bjønnes]

Colin Walters <walters(a)redhat.com&gt; writes:

| On Sun, 2005-03-06 at 22:45 +0100, Lars Gullik Bjønnes wrote:
> >Of the directory you mean? It is creating the file in the first place
> >that fails.
> >
> > ls -la /var/lib/ntp/
> >total 24
> >drwxr-xr-x   2 ntp  ntp  4096 Mar  6 22:20 .
> >drwxr-xr-x  14 root root 4096 Feb 22 17:38 ..
> >-rw-r--r--   1 ntp  ntp     7 Mar  6 22:20 drift
>  
| Do you have ntpd configured to run as root or something?

This is a FC3 install. No changes done.
(the ntp servers have been changed, but that is it.)

Kindo strange.

-- 
	Lgb

[Lars Gullik Bjønnes]

larsbj(a)gullik.net (Lars Gullik Bjønnes) writes:

| Colin Walters <walters(a)redhat.com&gt; writes:
>  
| | On Sun, 2005-03-06 at 22:45 +0100, Lars Gullik Bjønnes
wrote:
>
>  
>>>Of the directory you mean? It is creating the file
in the first place
>>>that fails.
>>
>  
>>> ls -la /var/lib/ntp/
>>>total 24
>>>drwxr-xr-x   2 ntp  ntp  4096 Mar  6 22:20 .
>>>drwxr-xr-x  14 root root 4096 Feb 22 17:38 ..
>>>-rw-r--r--   1 ntp  ntp     7 Mar  6 22:20 drift
>
>  
| | Do you have ntpd configured to run as root or something?
>  
| This is a FC3 install. No changes done.
| (the ntp servers have been changed, but that is it.)
>  
| Kindo strange.

Hmm da hmm...

I seem to have had a rouge process here... most likely created when I
tried to start ntpdc... I must have started ntpd manually instead.

So disregard all my reports. I'll inform you if I see some bad stuff
later.

Sorry about the false alarms.

-- 
	Lgb