[Users] SELinux denials on Sanlock

[Trey Dockendorf]

On Tue, Jun 19, 2012 at 12:48 PM, David Teigland <teigland at redhat.com> wrote:
> On Tue, Jun 19, 2012 at 01:29:30PM -0400, Daniel J Walsh wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 06/19/2012 12:13 PM, David Teigland wrote:
>> > type=AVC msg=audit(1340053766.745:7): avc:  denied  { open } for
>> >>> pid=1908 comm="wdmd" name="wdmd.pid" dev=dm-0 ino=1574530
>> >>> scontext=system_u:system_r:wdmd_t:s0
>> >>> tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
>> >>>
>> >>> type=AVC msg=audit(1340053766.746:8): avc:  denied  { lock } for
>> >>> pid=1908 comm="wdmd" path="/var/run/wdmd/wdmd.pid" dev=dm-0 ino=1574530
>> >>> scontext=system_u:system_r:wdmd_t:s0
>> >>> tcontext=system_u:object_r:initrc_var_run_t:s0 tclass=file
>> >>>
>> >>> type=SYSCALL msg=audit(1340053766.746:8): arch=x86_64 syscall=fcntl
>> >>> success=yes exit=0 a0=4 a1=6 a2=7fffae656290 a3=fffffff3 items=0 ppid=1
>> >>> pid=1908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
>> >>> sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=wdmd exe=/usr/sbin/wdmd
>> >>> subj=system_u:system_r:wdmd_t:s0 key=(null)
>>
>> THis is caused by a bug in sanlock, the init script for wdmd was creating the
>> /var/run/wdmd file but not running restorecon on it.
>
> Thanks, that was fixed back in Feb, so some old/wrong packages must be in
> use.

Thanks for the info.  I'll keep an eye on it but so far after manually
running restorecon it's a non-issue.

Not sure which version had the fix but this is latest in CentOS 6.2 install

sanlock.x86_64     1.8-2.el6      @base

Thanks
- Trey

>