Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 377425 - sec-policy/selinux-puppet ldap use flag not honored
Summary: sec-policy/selinux-puppet ldap use flag not honored
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Hardened (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Sven Vermeulen (RETIRED)
Depends on:
Reported: 2011-08-02 15:06 UTC by Matthew Thode ( prometheanfire )
Modified: 2011-10-23 13:16 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2011-08-02 15:06:14 UTC
type=AVC msg=audit(1312294578.971:872): avc:  denied  { name_connect } for  pid=1733 comm="puppetd" dest=636 scontext=system_u:system_r:puppet_t tcontext=system_u:object_r:ldap_port_t tclass=tcp_socket

Reproducible: Always

Steps to Reproduce:
run the puppet client when ldap is enabled as a use flag (I don't even have it being used in the puppet config)
Comment 1 Sven Vermeulen 2011-08-09 20:42:38 UTC
Indeed, ldap connectivity isn't allowed (yet) by the policy. Consider this confirmed ;-)

If you need a local workaround, create a file with the following contents:


  require {
    type puppet_t;


Then run "make -f /usr/share/selinux/strict/include/Makefile localmod.pp" after which you can run "semodule -i localmod.pp" to load in the updated policy.
Comment 2 Sven Vermeulen (RETIRED) gentoo-dev 2011-08-12 21:41:35 UTC
Hmm I'm wondering if this is sufficient or not.

Can you test that test module out to see if that helps? There is another interface available that allows send_msg and recv_msg but I'm not sure if that is needed here.
Comment 3 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2011-08-14 08:41:15 UTC
Seems to be working in overlay
Comment 4 Sven Vermeulen (RETIRED) gentoo-dev 2011-08-14 13:39:01 UTC
In hardened-dev overlay.
Comment 5 Sven Vermeulen (RETIRED) gentoo-dev 2011-08-29 09:20:40 UTC
In portage tree (~arch)