[FC5] rsyncd invocation from rc.local

Paul Howarth paul at city-fan.org
Sun Apr 9 13:47:05 UTC 2006


On Fri, 2006-04-07 at 20:43 -0400, mroselinux at eastgranby.k12.ct.us
wrote:
> I am migrating a samba server from FC3 to FC5.  I did a fresh install and
> have run into an SELINUX policy issue.  I have no problem logging on as
> root and typing in rsync --daemon, but when I insert the same line at the
> end of /etc/rc.d/rc.local and reboot, then /var/log/messages shows the
> following (with other stuff edited out).
> 
> ----------------------------------------------------------------------
> 
> 
> Apr  7 20:18:50 localhost kernel: hub 2-0:1.0: USB hub found
> Apr  7 20:18:50 localhost rsyncd[2062]: rsync: failed to open log-file
> /var/log/rsyncd.log: Permission denied (13)
> Apr  7 20:18:50 localhost rsyncd[2062]: Ignoring "log file" setting.
> Apr  7 20:18:50 localhost rsyncd[2062]: rsyncd version 2.6.6 starting,
> listening on port 873
> Apr  7 20:18:50 localhost rsyncd[2062]: unable to bind any inbound sockets
> on port 873
> Apr  7 20:18:50 localhost rsyncd[2062]: rsync error: error in socket IO
> (code 10) at socket.c(448)
> Apr  7 20:18:53 localhost kernel: SELinux: initialized (dev autofs, type
> autofs), uses genfs_contexts
> Apr  7 20:18:53 localhost kernel: ppdev: user-space parallel port driver
> Apr  7 20:18:53 localhost kernel: audit(1144455530.173:2): avc:  denied  {
> use } for  pid=2061 comm="rsync" name="0" dev=devpts ino=2
> scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:system_r:init_t:s0
> tclass=fd
> Apr  7 20:18:53 localhost kernel: audit(1144455530.173:3): avc:  denied  {
> use } for  pid=2061 comm="rsync" name="0" dev=devpts ino=2
> scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:system_r:init_t:s0
> tclass=fd
> Apr  7 20:18:53 localhost kernel: audit(1144455530.173:4): avc:  denied  {
> use } for  pid=2061 comm="rsync" name="0" dev=devpts ino=2
> scontext=system_u:system_r:rsync_t:s0 tcontext=system_u:system_r:init_t:s0
> tclass=fd
> Apr  7 20:18:53 localhost kernel: audit(1144455530.593:5): avc:  denied  {
> search } for  pid=2062 comm="rsync" name="log" dev=dm-0 ino=3309596
> scontext=system_u:system_r:rsync_t:s0
> tcontext=system_u:object_r:var_log_t:s0 tclass=dir
> Apr  7 20:18:53 localhost kernel: audit(1144455530.645:6): avc:  denied  {
> name_bind } for  pid=2062 comm="rsync" src=873
> scontext=system_u:system_r:rsync_t:s0
> tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket
> Apr  7 20:18:53 localhost kernel: audit(1144455530.645:7): avc:  denied  {
> name_bind } for  pid=2062 comm="rsync" src=873
> scontext=system_u:system_r:rsync_t:s0
> tcontext=system_u:object_r:rsync_port_t:s0 tclass=tcp_socket

The rsync policy appears to assume that rsyncd will run from xinetd
rather than using daemon mode. Not allowing rsync_t to bind to
rsync_port_t does look like a bit of an omission...

Paul.




More information about the fedora-selinux-list mailing list