[FC5] rsyncd invocation from rc.local

I am migrating a samba server from FC3 to FC5.  I did a fresh install and
have run into an SELINUX policy issue.  I have no problem logging on as
root and typing in rsync --daemon, but when I insert the same line at the
end of /etc/rc.d/rc.local and reboot, then /var/log/messages shows the
following (with other stuff edited out).

----------------------------------------------------------------------


Apr  7 20:18:50 localhost kernel: hub 2-0:1.0: USB hub found
Apr  7 20:18:50 localhost rsyncd[2062]: rsync: failed to open log-file
/var/log/rsyncd.log: Permission denied (13)
Apr  7 20:18:50 localhost rsyncd[2062]: Ignoring "log file" setting.
Apr  7 20:18:50 localhost rsyncd[2062]: rsyncd version 2.6.6 starting,
listening on port 873
Apr  7 20:18:50 localhost rsyncd[2062]: unable to bind any inbound sockets
on port 873
Apr  7 20:18:50 localhost rsyncd[2062]: rsync error: error in socket IO
(code 10) at socket.c(448)
Apr  7 20:18:53 localhost kernel: SELinux: initialized (dev autofs, type
autofs), uses genfs_contexts
Apr  7 20:18:53 localhost kernel: ppdev: user-space parallel port driver
Apr  7 20:18:53 localhost kernel: audit(1144455530.173:2): avc:  denied  {
use } for  pid=2061 comm="rsync" name="0" dev=devpts ino=2
scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:system_r:init_t:s0
tclass=fd
Apr  7 20:18:53 localhost kernel: audit(1144455530.173:3): avc:  denied  {
use } for  pid=2061 comm="rsync" name="0" dev=devpts ino=2
scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:system_r:init_t:s0
tclass=fd
Apr  7 20:18:53 localhost kernel: audit(1144455530.173:4): avc:  denied  {
use } for  pid=2061 comm="rsync" name="0" dev=devpts ino=2
scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:system_r:init_t:s0
tclass=fd
Apr  7 20:18:53 localhost kernel: audit(1144455530.593:5): avc:  denied  {
search } for  pid=2062 comm="rsync" name="log" dev=dm-0 ino=3309596
scontext=system_u:system_r:rsync_t:s0
tcontext=system_u:object_r:var_log_t:s0 tclass=dir
Apr  7 20:18:53 localhost kernel: audit(1144455530.645:6): avc:  denied  {
name_bind } for  pid=2062 comm="rsync" src=873
scontext=system_u:system_r:rsync_t:s0
tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
Apr  7 20:18:53 localhost kernel: audit(1144455530.645:7): avc:  denied  {
name_bind } for  pid=2062 comm="rsync" src=873
scontext=system_u:system_r:rsync_t:s0
tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
Apr  7 20:18:53 localhost kernel: [drm] Initialized drm 1.0.1 20051102
Apr  7 20:18:53 localhost kernel: ACPI: PCI Interrupt 0000:00:02.0[A] ->
GSI 16 (level, low) -> IRQ 19
Apr  7 20:18:53 localhost kernel: [drm] Initialized i915 1.4.0 20060119 on
minor 0
Apr  7 20:21:39 localhost gconfd (root-2295): starting (version 2.14.0),
pid 2295 user 'root'
Apr  7 20:21:39 localhost gconfd (root-2295): Resolved address
"xml:readonly:/etc/gconf/gconf.xml.mandatory" to a read-only configuration
source at position 0
Apr  7 20:21:39 localhost gconfd (root-2295): Resolved address
"xml:readwrite:/root/.gconf" to a writable configuration source at
position 1
Apr  7 20:21:39 localhost gconfd (root-2295): Resolved address
"xml:readonly:/etc/gconf/gconf.xml.defaults" to a read-only configuration
source at position 2
Apr  7 20:21:40 localhost gconfd (root-2295): Resolved address
"xml:readwrite:/root/.gconf" to a writable configuration source at
position 0
Apr  7 20:21:41 localhost kernel: audit(1144455701.420:8): avc:  denied  {
use } for  pid=2330 comm="bluez-pin" name="[7435]" dev=pipefs
ino=7435
scontext=root:system_r:bluetooth_helper_t:s0-s0:c0.c255
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=fd
Apr  7 20:21:41 localhost kernel: audit(1144455701.420:9): avc:  denied  {
use } for  pid=2330 comm="bluez-pin" name="[7435]" dev=pipefs
ino=7435
scontext=root:system_r:bluetooth_helper_t:s0-s0:c0.c255
tcontext=system_u:system_r:xdm_t:s0-s0:c0.c255 tclass=fd

------------------------------------------------------------------------------

What do I need to do to allow rsync --daemon from within /etc/rc.d/rc.local?


Mark Orenstein
East Granby (CT) School System

[Daniel J Walsh]

To modify local policy you can execute the following

grep rsync_t /var/log/messages | audit2allow -M rsync
semodule -i rsync.pp

rsync wanting to listen on rsync_port_t should be allowed, that is a bug 
in policy.

Probably can dontaudit useing init_t:fd and searching var_log_t.

Will add rsync binding to rsync_port_t to policy.

samba net command does not execute

The samba net command does not execute unless I change selinux to permissive.

Apr 10 19:12:02 localhost kernel: audit(1144710722.223:158): avc:  denied 
{ write } for  pid=3615 comm="net" name="group_mapping.tdb" dev=dm-0
ino=3310700 scontext=root:system_r:samba_net_t:s0-s0:c0.c255
tcontext=root:object_r:samba_var_t:s0 tclass=file
Apr 10 19:12:02 localhost net: [2006/04/10 19:12:02.227587, 0]
groupdb/mapping.c:init_group_mapping(134)
Apr 10 19:12:02 localhost net:   Failed to open group mapping database
Apr 10 19:12:02 localhost net: [2006/04/10 19:12:02.228030, 0]
groupdb/mapping.c:enum_group_mapping(415)
Apr 10 19:12:02 localhost net:   failed to initialize group mapping

Is there a simple fix while leaving selinux enabled?

Mark Orenstein
East Granby School System

samba net command does not execute

>  The samba net command does not execute unless I change selinux to
>  permissive.
>
>  Apr 10 19:12:02 localhost kernel: audit(1144710722.223:158): avc:  denied
>  { write } for  pid=3615 comm="net" name="group_mapping.tdb" dev=dm-0
>  ino=3310700 scontext=root:system_r:samba_net_t:s0-s0:c0.c255
>  tcontext=root:object_r:samba_var_t:s0 tclass=file
>  Apr 10 19:12:02 localhost net: [2006/04/10 19:12:02.227587, 0]
>  groupdb/mapping.c:init_group_mapping(134)
>  Apr 10 19:12:02 localhost net:   Failed to open group mapping database
>  Apr 10 19:12:02 localhost net: [2006/04/10 19:12:02.228030, 0]
>  groupdb/mapping.c:enum_group_mapping(415)
>  Apr 10 19:12:02 localhost net:   failed to initialize group mapping
>
>  Is there a simple fix while leaving selinux enabled?
>
>  Mark Orenstein
>  East Granby School System
>
>  --
>  fedora-selinux-list mailing list
>  fedora-selinux-list(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  
Just to be more specific, it is the "net groupmap" command that will not
execute properly with selinux enabled.

[Paul Howarth]

On Fri, 2006-04-07 at 20:43 -0400, mroselinux(a)eastgranby.k12.ct.us
wrote:
>  I am migrating a samba server from FC3 to FC5.  I did a fresh install
> and
>  have run into an SELINUX policy issue.  I have no problem logging on as
>  root and typing in rsync --daemon, but when I insert the same line at the
>  end of /etc/rc.d/rc.local and reboot, then /var/log/messages shows the
>  following (with other stuff edited out).
>  
>  ----------------------------------------------------------------------
>  
>  
>  Apr  7 20:18:50 localhost kernel: hub 2-0:1.0: USB hub found
>  Apr  7 20:18:50 localhost rsyncd[2062]: rsync: failed to open log-file
>  /var/log/rsyncd.log: Permission denied (13)
>  Apr  7 20:18:50 localhost rsyncd[2062]: Ignoring "log file" setting.
>  Apr  7 20:18:50 localhost rsyncd[2062]: rsyncd version 2.6.6 starting,
>  listening on port 873
>  Apr  7 20:18:50 localhost rsyncd[2062]: unable to bind any inbound sockets
>  on port 873
>  Apr  7 20:18:50 localhost rsyncd[2062]: rsync error: error in socket IO
>  (code 10) at socket.c(448)
>  Apr  7 20:18:53 localhost kernel: SELinux: initialized (dev autofs, type
>  autofs), uses genfs_contexts
>  Apr  7 20:18:53 localhost kernel: ppdev: user-space parallel port driver
>  Apr  7 20:18:53 localhost kernel: audit(1144455530.173:2): avc:  denied  {
>  use } for  pid=2061 comm="rsync" name="0" dev=devpts ino=2
>  scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:system_r:init_t:s0
>  tclass=fd
>  Apr  7 20:18:53 localhost kernel: audit(1144455530.173:3): avc:  denied  {
>  use } for  pid=2061 comm="rsync" name="0" dev=devpts ino=2
>  scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:system_r:init_t:s0
>  tclass=fd
>  Apr  7 20:18:53 localhost kernel: audit(1144455530.173:4): avc:  denied  {
>  use } for  pid=2061 comm="rsync" name="0" dev=devpts ino=2
>  scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:system_r:init_t:s0
>  tclass=fd
>  Apr  7 20:18:53 localhost kernel: audit(1144455530.593:5): avc:  denied  {
>  search } for  pid=2062 comm="rsync" name="log" dev=dm-0 ino=3309596
>  scontext=system_u:system_r:rsync_t:s0
>  tcontext=system_u:object_r:var_log_t:s0 tclass=dir
>  Apr  7 20:18:53 localhost kernel: audit(1144455530.645:6): avc:  denied  {
>  name_bind } for  pid=2062 comm="rsync" src=873
>  scontext=system_u:system_r:rsync_t:s0
>  tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
>  Apr  7 20:18:53 localhost kernel: audit(1144455530.645:7): avc:  denied  {
>  name_bind } for  pid=2062 comm="rsync" src=873
>  scontext=system_u:system_r:rsync_t:s0
>  tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket 
The rsync policy appears to assume that rsyncd will run from xinetd
rather than using daemon mode. Not allowing rsync_t to bind to
rsync_port_t does look like a bit of an omission...

Paul.