[CentOS] selinux & httpd & portmap

[Craig White]

On Mon, 2008-07-28 at 09:24 -0400, Toby Bluhm wrote:

> Sometimes labeling problems can cause SELinux denials. You could try to 
> restore
> the default system file context for ./kernel,
> 
> restorecon -v './kernel'
----
did you try this?
----
> 
> If this does not work, there is currently no automatic way to allow this 
> access.
> Instead, you can generate a local policy module to allow this access - 
> see FAQ
> (http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can 
> disable
> SELinux protection altogether. Disabling SELinux protection is not 
> recommended.
> Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
> against this package.
> 
> Additional Information:
> 
> Source Context                system_u:system_r:clamd_t:s0
> Target Context                system_u:object_r:sysctl_kernel_t:s0
> Target Objects                ./kernel [ dir ]
> Source                        clamd
> Source Path                   /usr/sbin/clamd
> Port                          <Unknown>
> Host                          <Unknown>
> Source RPM Packages           clamd-0.93.3-1.el5.rf
> Target RPM Packages
> Policy RPM                    selinux-policy-2.4.6-137.1.el5
> Selinux Enabled               True
> Policy Type                   targeted
> MLS Enabled                   True
> Enforcing Mode                Permissive
> Plugin Name                   catchall_file
> Host Name                     mail.alltechmedicalsystemsamerica.com
> Platform                      Linux mail.alltechmedicalsystemsamerica.com
>                                2.6.18-92.1.6.el5 #1 SMP Wed Jun 25 
> 13:49:24 EDT
>                                2008 i686 athlon
> Alert Count                   1
> First Seen                    Fri Jul 25 14:44:44 2008
> Last Seen                     Fri Jul 25 14:44:44 2008
> Local ID                      8e3e4626-632c-4abc-b520-89c65771babf
> Line Numbers                  8, 9, 10
> 
> Raw Audit Messages
> 
> type=AVC msg=audit(1217011484.818:9): avc:  denied  { search } for 
> pid=2026 comm="clamd" name="kernel" dev=proc ino=-268435416 
> scontext=system_u:system_r:clamd_t:s0 
> tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir
> 
> type=AVC msg=audit(1217011484.818:9): avc:  denied  { read } for 
> pid=2026 comm="clamd" name="ngroups_max" dev=proc ino=-268435368 
> scontext=system_u:system_r:clamd_t:s0 
> tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file
> 
> type=SYSCALL msg=audit(1217011484.818:9): arch=40000003 syscall=5 
> success=yes exit=3 a0=265c24 a1=0 a2=27fff4 a3=281994 items=0 ppid=2025 
> pid=2026 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 
> fsgid=0 tty=(none) ses=4294967295 comm="clamd" exe="/usr/sbin/clamd" 
> subj=system_u:system_r:clamd_t:s0 key=(null)
----
this one is a bit beyond me unless the 

restorecon -v './kernel'

works - you might want to check in on the selinux-list...
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

Craig