new selinux problems

I'm seeing a problem with pmdaroot on vm26 (x86_64, Fedora 21).

The pmdaroot never really starts and the log contains

[Sat Feb 11 15:11:09] pmdaroot(11177) Error: setup: __pmBind failed: Address already in use

And I see this in /var/log/audit

[root@vm26 audit]# grep AVC audit.log | sed -e 's/audit([^)]*)/audit(...)/' -e 's/pid=[0-9][0-9]*/pid=NNN/' | sort | uniq
type=AVC msg=audit(...): avc:  denied  { getattr } for  pid=NNN comm="perl" path="/var/log/pcp/rsyslog/stats" dev="dm-0" ino=537047 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:pcp_log_t:s0 tclass=fifo_file permissive=0
type=AVC msg=audit(...): avc:  denied  { read } for  pid=NNN comm="pmcd" name="primary" dev="dm-0" ino=529229 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_var_lib_t:s0 tclass=lnk_file permissive=0
type=AVC msg=audit(...): avc:  denied  { read } for  pid=NNN comm="pmcd" name="primary" dev="dm-0" ino=529945 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_var_lib_t:s0 tclass=lnk_file permissive=0
type=AVC msg=audit(...): avc:  denied  { read } for  pid=NNN comm="pmcd" name="primary" dev="dm-0" ino=536986 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_var_lib_t:s0 tclass=lnk_file permissive=0
type=AVC msg=audit(...): avc:  denied  { search } for  pid=NNN comm="pmcd" name="net" dev="proc" ino=8796 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0
type=AVC msg=audit(...): avc:  denied  { search } for  pid=NNN comm="pmcd" name="net" dev="proc" ino=8857 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=dir permissive=0
type=AVC msg=audit(...): avc:  denied  { unlink } for  pid=NNN comm="pmdaroot" name="root.socket" dev="dm-0" ino=525347 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:pcp_var_lib_t:s0 tclass=sock_file permissive=0
type=AVC msg=audit(...): avc:  denied  { write } for  pid=NNN comm="pmcd" name="root.socket" dev="dm-0" ino=525347 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:pcp_var_lib_t:s0 tclass=sock_file permissive=0
type=AVC msg=audit(...): avc:  denied  { write } for  pid=NNN comm="pmdalinux" name="root.socket" dev="dm-0" ino=525347 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:pcp_var_lib_t:s0 tclass=sock_file permissive=0
type=AVC msg=audit(...): avc:  denied  { write } for  pid=NNN comm="pmdaproc" name="root.socket" dev="dm-0" ino=525347 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:pcp_var_lib_t:s0 tclass=sock_file permissive=0
[root@vm26 audit]# 

I think the root.socket ones explain the pmdaroot exit.

And if I run

	# setenforce 0
	# systemctl restart pmcd pmlogger

then everything runs fine.

The other AVC lines appear to be other problems that need to be investigated.

-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links:

You receive all messages sent to this group.

View/Reply Online (#15113): https://groups.io/g/pcp/message/15113
View All Messages In Topic (1): https://groups.io/g/pcp/topic/4357222
Mute This Topic: https://groups.io/mt/4357222?uid=174580
New Topic: https://groups.io/g/pcp/post
-=-=-
pcp mailing list
[email protected]
https://groups.io/g/pcp/messages
-=-=-
Change Your Subscription: https://groups.io/g/pcp/editsub?uid=174580
Group Home: https://groups.io/g/pcp
Contact Group Owner: [email protected]
Terms of Service: https://groups.io/static/tos
Unsubscribe: https://groups.io/g/pcp/leave/354243/563757577/xyzzy
-=-=-=-=-=-=-=-=-=-=-=-