I'm running both named and dhcpd, and dhcpd is set to do dynamic dns updates (both use /etc/rndc.key as the authentication key). All used to be good, but now dhcpd won't start, and errors in the kernel log show:
audit(1107297176.619:0): avc: denied { search } for pid=8099 exe=/usr/sbin/dhcpd name=named dev=sda1 ino=1295119 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:named_zone_t tclass=dir
which I'm quite sure is related to the ownership rights on /etc/rndc.key (which just points to /var/named/chroot/etc/rndc.key):
/etc/rndc.* -- system_u:object_r:named_conf_t
and as far as I understand it, there isn't a way to specify multiple contexts. Does anyone know how to solve this?
Regards, Tim
On Tue, 1 Feb 2005 14:38:54 -0800, Tim Fenn fenn@stanford.edu wrote:
I'm running both named and dhcpd, and dhcpd is set to do dynamic dns updates (both use /etc/rndc.key as the authentication key). All used to be good, but now dhcpd won't start, and errors in the kernel log show:
audit(1107297176.619:0): avc: denied { search } for pid=8099 exe=/usr/sbin/dhcpd name=named dev=sda1 ino=1295119 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:named_zone_t tclass=dir
ask in the fedora-selinux list
On Wed, Feb 02, 2005 at 06:14:25PM +0530, Rahul Sundaram wrote:
On Tue, 1 Feb 2005 14:38:54 -0800, Tim Fenn fenn@stanford.edu wrote:
I'm running both named and dhcpd, and dhcpd is set to do dynamic dns updates (both use /etc/rndc.key as the authentication key). All used to be good, but now dhcpd won't start, and errors in the kernel log show:
audit(1107297176.619:0): avc: denied { search } for pid=8099 exe=/usr/sbin/dhcpd name=named dev=sda1 ino=1295119 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:named_zone_t tclass=dir
ask in the fedora-selinux list
<sigh>... yet another mailing list...
I filed a bug report, workarounds are suggested at:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146844
Regards, Tim
Change selinux to allow Dynamic DNS:
Edit the following file and change the '0' to '1':
/etc/selinux/targeted/booleans named_write_master_zones=1
By default it looks like selinux denies writing of DDNS. Also check that named has write permissions to the directory where your zone files are stored.
-Darren
Tim Fenn wrote:
On Wed, Feb 02, 2005 at 06:14:25PM +0530, Rahul Sundaram wrote:
On Tue, 1 Feb 2005 14:38:54 -0800, Tim Fenn fenn@stanford.edu wrote:
I'm running both named and dhcpd, and dhcpd is set to do dynamic dns updates (both use /etc/rndc.key as the authentication key). All used to be good, but now dhcpd won't start, and errors in the kernel log show:
audit(1107297176.619:0): avc: denied { search } for pid=8099 exe=/usr/sbin/dhcpd name=named dev=sda1 ino=1295119 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:named_zone_t tclass=dir
ask in the fedora-selinux list
<sigh>... yet another mailing list...
I filed a bug report, workarounds are suggested at:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146844
Regards, Tim
Darren Grant wrote:
Change selinux to allow Dynamic DNS:
Edit the following file and change the '0' to '1':
/etc/selinux/targeted/booleans named_write_master_zones=1
By default it looks like selinux denies writing of DDNS. Also check that named has write permissions to the directory where your zone files are stored.
That will only do it on the next reboot.
setsebool -P named_write_master_zones=1
Will set it on now and edit the file for you.
system-config-securitylevel will do all this with a GUI.
Dan
-Darren
Tim Fenn wrote:
On Wed, Feb 02, 2005 at 06:14:25PM +0530, Rahul Sundaram wrote:
On Tue, 1 Feb 2005 14:38:54 -0800, Tim Fenn fenn@stanford.edu wrote:
I'm running both named and dhcpd, and dhcpd is set to do dynamic dns updates (both use /etc/rndc.key as the authentication key). All used to be good, but now dhcpd won't start, and errors in the kernel log show:
audit(1107297176.619:0): avc: denied { search } for pid=8099 exe=/usr/sbin/dhcpd name=named dev=sda1 ino=1295119 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:named_zone_t tclass=dir
ask in the fedora-selinux list
<sigh>... yet another mailing list...
I filed a bug report, workarounds are suggested at:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146844
Regards, Tim
Darren Grant wrote:
Change selinux to allow Dynamic DNS:
Edit the following file and change the '0' to '1':
/etc/selinux/targeted/booleans named_write_master_zones=1
By default it looks like selinux denies writing of DDNS. Also check that named has write permissions to the directory where your zone files are stored.
-Darren
Tim Fenn wrote:
On Wed, Feb 02, 2005 at 06:14:25PM +0530, Rahul Sundaram wrote:
On Tue, 1 Feb 2005 14:38:54 -0800, Tim Fenn fenn@stanford.edu wrote:
I'm running both named and dhcpd, and dhcpd is set to do dynamic dns updates (both use /etc/rndc.key as the authentication key). All used to be good, but now dhcpd won't start, and errors in the kernel log show:
audit(1107297176.619:0): avc: denied { search } for pid=8099 exe=/usr/sbin/dhcpd name=named dev=sda1 ino=1295119 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:named_zone_t tclass=dir
ask in the fedora-selinux list
<sigh>... yet another mailing list...
I filed a bug report, workarounds are suggested at:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146844
Regards, Tim
While we're on the subject of SELinux... anyone know of any good primers for those of us who may not be very familiar with SELinux yet? Perhaps some tutorials or articles explaining real-world scenarios of where SELinux is used, how it's used, and what the outcome is?
Thanks -dant
dan wrote:
Darren Grant wrote:
Change selinux to allow Dynamic DNS:
Edit the following file and change the '0' to '1':
/etc/selinux/targeted/booleans named_write_master_zones=1
By default it looks like selinux denies writing of DDNS. Also check that named has write permissions to the directory where your zone files are stored.
-Darren
Tim Fenn wrote:
On Wed, Feb 02, 2005 at 06:14:25PM +0530, Rahul Sundaram wrote:
On Tue, 1 Feb 2005 14:38:54 -0800, Tim Fenn fenn@stanford.edu wrote:
I'm running both named and dhcpd, and dhcpd is set to do dynamic dns updates (both use /etc/rndc.key as the authentication key). All used to be good, but now dhcpd won't start, and errors in the kernel log show:
audit(1107297176.619:0): avc: denied { search } for pid=8099 exe=/usr/sbin/dhcpd name=named dev=sda1 ino=1295119 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:named_zone_t tclass=dir
ask in the fedora-selinux list
<sigh>... yet another mailing list...
I filed a bug report, workarounds are suggested at:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=146844
Regards, Tim
While we're on the subject of SELinux... anyone know of any good primers for those of us who may not be very familiar with SELinux yet? Perhaps some tutorials or articles explaining real-world scenarios of where SELinux is used, how it's used, and what the outcome is?
Thanks -dant
THere is a book out on it, avaliable http://www.amazon.com/exec/obidos/search-handle-form/102-3867490-1431367 You can attend the SELinux symposium. The FAQ has some useful info. http://fedora.redhat.com/docs/selinux-faq-fc3/
Dan
On Wed, Feb 02, 2005 at 11:26:03AM -0800, Darren Grant wrote:
Change selinux to allow Dynamic DNS:
Edit the following file and change the '0' to '1':
/etc/selinux/targeted/booleans named_write_master_zones=1
I'll check this out, but the error seems to be related to a search, not a write call. More explicitly, my logs show (and I should have included the gritty details and not just the selinux error in my OP):
dhcpd: Internet Systems Consortium DHCP Server V3.0.1 dhcpd: Copyright 2004 Internet Systems Consortium. dhcpd: All rights reserved. dhcpd: For info, please visit http://www.isc.org/sw/dhcp/ audit(1107297176.619:0): avc: denied { search } for pid=8099 exe=/usr/sbin/dhcpd name=named dev=sda1 ino=1295119 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:named_zone_t tclass=dir dhcpd: Can't open /etc/rndc.key: Permission denied dhcpd: ... dhcpd: exiting.
My current workaround was to make a hard link from /etc/rndc.key from /var/named/chroot/etc/rndc.key, comment out this line from /etc/selinux/targeted/contexts/files/file_contexts:
/etc/rndc.* -- system_u:object_r:named_conf_t
then run restorecon on /etc/rndc*, and then dhcpd started up fine, and writes to master zones also seems to be working.
Alternative solutions are on the bugzilla report.
Regards, Tim
Tim Fenn wrote:
On Wed, Feb 02, 2005 at 11:26:03AM -0800, Darren Grant wrote:
Change selinux to allow Dynamic DNS:
Edit the following file and change the '0' to '1':
/etc/selinux/targeted/booleans named_write_master_zones=1
I'll check this out, but the error seems to be related to a search, not a write call. More explicitly, my logs show (and I should have included the gritty details and not just the selinux error in my OP):
dhcpd: Internet Systems Consortium DHCP Server V3.0.1 dhcpd: Copyright 2004 Internet Systems Consortium. dhcpd: All rights reserved. dhcpd: For info, please visit http://www.isc.org/sw/dhcp/ audit(1107297176.619:0): avc: denied { search } for pid=8099 exe=/usr/sbin/dhcpd name=named dev=sda1 ino=1295119 scontext=root:system_r:dhcpd_t tcontext=system_u:object_r:named_zone_t tclass=dir dhcpd: Can't open /etc/rndc.key: Permission denied dhcpd: ... dhcpd: exiting.
My current workaround was to make a hard link from /etc/rndc.key from /var/named/chroot/etc/rndc.key, comment out this line from /etc/selinux/targeted/contexts/files/file_contexts:
/etc/rndc.* -- system_u:object_r:named_conf_t
then run restorecon on /etc/rndc*, and then dhcpd started up fine, and writes to master zones also seems to be working.
Alternative solutions are on the bugzilla report.
Regards, Tim
Yes this "fix" will not fix your problem. We are working on a solution for you .