selinux, squid

[Daniel J Walsh]

Richard Pannell wrote:

>
> >On Thu, 2005-08-11 at 13:47 +0800, Richard Pannell wrote:
> >>
> >> I am having problems running squid authentication (ntlm_auth) in FC4
> >> with selinux turned on. When I use setenforce 0 I have no problems.
> >> But with setenforce set to 1 it fails. So using "audit2allow -l
> >> -i /var/log/message" I got the following result
> >>
> >> allow auditd_t initrc_t:unix_dgram_socket sendto;
> >> allow klogd_t device_t:sock_file write;
> >> allow klogd_t initrc_t:unix_dgram_socket sendto;
> >> allow rpcd_t etc_runtime_t:file read;
> >> allow rpcd_t proc_t:file read;
> >> allow rpcd_t samba_etc_t:dir search;
> >> allow rpcd_t samba_var_t:dir { getattr search };
> >> allow syslogd_t etc_runtime_t:file read;
> >> allow syslogd_t proc_t:file read;  
> >>
> >> which I added
> >> to /etc/selinux/targeted/src/policy/domains/misc/local.te and ran  
> >>
> >> make -C /etc/selinux/targeted/src/policy clean
> >> make -C /etc/selinux/targeted/src/policy load
> >
> >Do you get the same output from audit2allow after doing this?
> Yes I am.
> >
> >Are you running auditd? If so, you should be looking
> >in /var/log/audit/audit.log rather than /var/log/messages for AVC
> >errors.
> Yes I am. So it was showing.
>
> allow apmd_t device_t:sock_file write;
> allow apmd_t devpts_t:chr_file { getattr ioctl };
> allow apmd_t devpts_t:dir search;
> allow apmd_t initrc_t:unix_dgram_socket sendto;
> allow apmd_t selinux_config_t:file read;
> allow auditd_t device_t:sock_file write;
> allow bluetooth_t device_t:sock_file write;
> allow httpd_t winbind_var_run_t:dir getattr;
> allow ntpd_t device_t:sock_file write;
> allow ntpd_t initrc_t:unix_dgram_socket sendto;
> allow system_dbusd_t device_t:sock_file write;
> allow system_dbusd_t initrc_t:unix_dgram_socket sendto;
> allow system_dbusd_t winbind_var_run_t:dir getattr;
> allow updfstab_t device_t:sock_file write;
> allow winbind_helper_t initrc_t:unix_stream_socket connectto;
> allow winbind_helper_t samba_var_t:dir search;
>
> Added this to the local.te file which worked thanks very much.
> >
> >Paul. 

First off this looks like you have a mislabeled /dev/log file?
restorecon -v /dev/log

Does adding

allow winbind_helper_t samba_var_t:dir search;

only fix the problem?

Could you attach the avc messages used to generate the audit rules?

Dan

--