Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: jetty-8.1.0-4.fc17.noarch causes SELinux AVCs, won't start in enforcing mode
https://bugzilla.redhat.com/show_bug.cgi?id=797928
Summary: jetty-8.1.0-4.fc17.noarch causes SELinux AVCs, won't
start in enforcing mode
Product: Fedora
Version: 17
Platform: x86_64
OS/Version: Linux
Status: NEW
Severity: unspecified
Priority: unspecified
Component: jetty
AssignedTo: sochotni(a)redhat.com
ReportedBy: selinux(a)gmail.com
QAContact: extras-qa(a)fedoraproject.org
CC: overholt(a)redhat.com, sochotni(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org
Classification: Fedora
Story Points: ---
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Description of problem:
jetty-8.1.0-4.fc17.noarch won't start in enforcing mode: it spews SELinux AVCs:
#============= initrc_t ==============
allow initrc_t http_cache_port_t:tcp_socket name_bind;
allow initrc_t hugetlbfs_t:file read;
allow initrc_t self:process execmem;
Appears that /usr/share/jetty/bin/jetty.sh exec's Java while running under
systemd's SELinux context ('initrc_t').
Shouldn't jetty/java transition to a different context (e.g., httpd_t, or a new
'jetty_t')? If so, probably need to add something so it can access
/var/log/jetty.
Here are the actual AVCs from /var/log/audit/audit.log when I booted with
'enforcing=0':
type=SERVICE_START msg=audit(1330353641.267:29): pid=0 uid=0 auid=4294967295
ses=4294967295 subj=system_u:system_r:init_t:s0 msg=': comm="jetty"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1330353642.590:31): avc: denied { read } for pid=747
comm="java" path=2F616E6F6E5F6875676570616765202864656C6574656429
dev="hugetlbfs" ino=17376 scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:object_r:hugetlbfs_t:s0 tclass=file
type=SYSCALL msg=audit(1330353642.590:31): arch=c000003e syscall=9 success=no
exit=-12 a0=0 a1=200000 a2=3 a3=40022 items=0 ppid=1 pid=747 auid=4294967295
uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
ses=4294967295 comm="java"
exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.3.x86_64/jre/bin/java"
subj=system_u:system_r:initrc_t:s0 key=(null)
type=AVC msg=audit(1330353643.581:33): avc: denied { execmem } for pid=747
comm="java" scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:system_r:initrc_t:s0 tclass=process
type=SYSCALL msg=audit(1330353643.581:33): arch=c000003e syscall=9 success=yes
exit=140008165998592 a0=7f5631000000 a1=270000 a2=7 a3=32 items=0 ppid=1
pid=747 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) ses=4294967295 comm="java"
exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.3.x86_64/jre/bin/java"
subj=system_u:system_r:initrc_t:s0 key=(null)
type=AVC msg=audit(1330353671.705:53): avc: denied { name_bind } for pid=747
comm="java" src=8080 scontext=system_u:system_r:initrc_t:s0
tcontext=system_u:object_r:http_cache_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1330353671.705:53): arch=c000003e syscall=49 success=yes
exit=0 a0=39 a1=7f563a0c74c0 a2=1c a3=7f563a0c7230 items=0 ppid=1 pid=747
auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0
tty=(none) ses=4294967295 comm="java"
exe="/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.3.x86_64/jre/bin/java"
subj=system_u:system_r:initrc_t:s0 key=(null)
type=SOCKADDR msg=audit(1330353671.705:53):
saddr=0A001F90000000000000000000000000000000000000000000000000
Version-Release number of selected component (if applicable):
jetty-8.1.0-4.fc17.noarch
selinux-policy-3.10.0-93.fc17.noarch
How reproducible:
Every boot
Steps to Reproduce:
1. install jetty
2. boot
3.
Actual results:
Expected results:
Additional info:
--
Configure bugmail:
https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.