Re: systemd strangeness

Hi Ken,

"Ken McDonell" <[email protected]> writes:
[...]
> This means nothing to me I'm afraid, so if you know how to fix it, I'd
> be most appreciative of the recipe, especially as I have a cluster of
> other unexplained QA failures, e.g. using pmdatrace that also uses a
> tcp socket.

Thanks for the log file.

The short answer:

Running these two commands (as root) should fix those errors
# setsebool -P nis_enabled 1
# setsebool -P pcp_bind_all_unreserved_ports 1

and then, of course
#setenforce 1
:)

The (slightly) longer answer;

SELinux is a permissions system in additional to traditional unix
permissions.  Essentially, every type of file and process gets it's own
'context' which acts as a label.

ls -Z /usr/libexec/pcp/bin/pmcd
system_u:object_r:pcp_pmcd_exec_t:s0 /usr/libexec/pcp/bin/pmcd
|-user -|--role--|----context----|
                          ^ what we're concerned with

SELinux keeps track of how each type of 'context' can interact with each
other, for example, it'd make sense for a file with, say, 'httpd_t'
context (or something similar, just need to know apache is doing this)
to read or write to a file under /var/www/.  However, it definitely
wouldn't make sense in typical use cases, to let httpd_t access something
under /var/lib/pcp/, so SELinux would deny that read/write/whatever.

In practical terms, what I did was take your output and run it through
audit2allow.

`cat /var/log/audit/audit.log | audit2allow -w` will spit out a plain
english report and the denials

`cat /var/log/audit/audit.log | audit2allow -M mypol` will produce both
the type enforcement file, and final policy package.  Which, in this
case, you could install with `semodule -i mypol.pp` and resolve the
issues.

I've got a more detailed write up on my selinux branch (which I'll
include these changes in my post tomorrow) in the README file if you're
interested.

Cheers,

Lukas



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links:

You receive all messages sent to this group.

View/Reply Online (#15080): https://groups.io/g/pcp/message/15080
View All Messages In Topic (7): https://groups.io/g/pcp/topic/4336473
Mute This Topic: https://groups.io/mt/4336473?uid=174580
New Topic: https://groups.io/g/pcp/post
-=-=-
pcp mailing list
[email protected]
https://groups.io/g/pcp/messages
-=-=-
Change Your Subscription: https://groups.io/g/pcp/editsub?uid=174580
Group Home: https://groups.io/g/pcp
Contact Group Owner: [email protected]
Terms of Service: https://groups.io/static/tos
Unsubscribe: https://groups.io/g/pcp/leave/354243/563757577/xyzzy
-=-=-=-=-=-=-=-=-=-=-=-