Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm having trouble setting up OpenVPN on my server running CentOS 6.2. I have used OpenVPN on this server before and it worked (although that was with Ubuntu, now I'm using CentOS). I just reformatted the hard drive and am trying to get OpenVPN up and running again. I use the up and down directives in my OpenVPN config file to setup my bridge. For some reason when the up script runs, I get a permission denied error when trying to execute brctl. Here's my config file:

mode server
tls-server

local 192.168.1.93 ##ip of server
port 1194
proto tcp

dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"

persist-key
persist-tun

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
#tls-auth ta.key 0

cipher BF-CBC
comp-lzo

ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.93 255.255.255.0 192.168.1.110 192.168.1.120
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DOMAIN nyc.rr.com"
max-clients 10

user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3

And here's the up.sh script:

#!/bin/sh

BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/usr/sbin/brctl addif $BR $DEV

brctl works fine outside of this script. I'm able to execute it manually.

I start OpenVPN as root, so I don't think permissions in the issue, so that's why I'm so confused.

Thanks for any help.

EDIT: Here's the error that's echoed:

[root@server openvpn]# /etc/init.d/openvpn start Starting openvpn: /etc/openvpn/up.sh: line 7: /usr/sbin/brctl: Permission denied [FAILED]

share|improve this question
    
Is there anything in /var/log/messages or audit? Checked selinux? –  Bart De Vos Jun 4 '12 at 23:07
    
This is logged in messages: WARNING: Failed running command (--up/--down): external program exited with error status: 126 –  edc1591 Jun 4 '12 at 23:09
    
Nothing in audit. And what do you mean by "checked selinux? –  edc1591 Jun 4 '12 at 23:10
    
Error 126 is "not executable". Have you chmod +xed the script? –  SmallClanger Jun 5 '12 at 9:28
    
Yup, same problem. I also realized I forgot to post the error. I've edited my post. –  edc1591 Jun 5 '12 at 23:07
add comment

1 Answer 1

up vote 1 down vote accepted

I believe you hit this bug.

Create file openvpnlocal.te:

module openvpnlocal 1.0;
require {
    type openvpn_t;
    type brctl_exec_t;
    class file { read execute open execute_no_trans };
}
#============= openvpn_t ==============
allow openvpn_t brctl_exec_t:file { read execute open execute_no_trans };

Then run:

checkmodule -M -m -o openvpnlocal.mod openvpnlocal.te
semodule_package -o openvpnlocal.pp -m openvpnlocal.mod
semodule -i openvpnlocal.pp
share|improve this answer
    
That worked! Thanks! –  edc1591 Jun 6 '12 at 23:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.