Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to run an OpenLDAP server on CentOS 6.4 with selinux enabled, but slapd is dieing as soon as it's started via /etc/init.d/slapd start. (init script reports OK; everything works fine after setenforce 0.

found these messages in /var/log/audit/audit.log:

type=AVC msg=audit(1372888328.397:3262): avc:  denied  { write } for  pid=1492 comm="slapd" name="slapd.log" dev=dm-0 ino=4348 scontext=unconfined_u:system_r:slapd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file
type=SYSCALL msg=audit(1372888328.397:3262): arch=40000003 syscall=5 success=no exit=-13 a0=1bd1018 a1=241 a2=1b6 a3=7ea191 items=0 ppid=1491 pid=1492 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=337 comm="slapd" exe="/usr/sbin/slapd" subj=unconfined_u:system_r:slapd_t:s0 key=(null)
type=AVC msg=audit(1372888328.408:3263): avc:  denied  { sys_nice } for  pid=1492 comm="slapd" capability=23  scontext=unconfined_u:system_r:slapd_t:s0 tcontext=unconfined_u:system_r:slapd_t:s0 tclass=capability
type=SYSCALL msg=audit(1372888328.408:3263): arch=40000003 syscall=156 success=yes exit=0 a0=5d4 a1=0 a2=bfe64968 a3=b787a6c0 items=0 ppid=1491 pid=1492 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=337 comm="slapd" exe="/usr/sbin/slapd" subj=unconfined_u:system_r:slapd_t:s0 key=(null)
type=AVC msg=audit(1372888328.424:3264): avc:  denied  { read } for  pid=1493 comm="slapd" name="log.0000000001" dev=dm-0 ino=263969 scontext=unconfined_u:system_r:slapd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file
type=SYSCALL msg=audit(1372888328.424:3264): arch=40000003 syscall=5 success=no exit=-13 a0=1c78270 a1=8000 a2=0 a3=0 items=0 ppid=1 pid=1493 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=337 comm="slapd" exe="/usr/sbin/slapd" subj=unconfined_u:system_r:slapd_t:s0 key=(null)

However this leaves me with no idea how to fix it. How do I tell selinux to allow the LDAP daemon to run?


I tried

restorecon -v -F -R /etc/openldap
restorecon -v -F -R /var/lib/ldap

but this didn't work (and in fact it seems to have broken my ability to start slapd even with selinux disabled). Got a lot of messages like

restorecon reset /etc/openldap/cacerts context unconfined_u:object_r:etc_t:s0->system_u:object_r:etc_t:s0

share|improve this question
    
I have a feeling that your ldap database is stored in a place other than /var/lib/ldap (which is labelled properly). As for the niceness -- I cant find any documentation suggesting slapd can actually change its niceness, if it can, its a bug in policy to not allow it. –  Matthew Ife Oct 16 '13 at 19:24

1 Answer 1

If you filter the audit logs through audit2allow(1) and audit2why you'll get an approximate idea of what is happening:

#============= slapd_t ==============
allow slapd_t self:capability sys_nice;
allow slapd_t var_log_t:file { write read };
------------------------------------

    Was caused by:
            Missing type enforcement (TE) allow rule.

            You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1372888328.408:3263): avc:  denied  { sys_nice } for  pid=1492 comm=slapd capability=23  scontext=unconfined_u:system_r:slapd_t:s0 tcontext=unconfined_u:system_r:slapd_t:s0 tclass=capability

    Was caused by:
            Missing type enforcement (TE) allow rule.

            You can use audit2allow to generate a loadable module to allow this access.

type=AVC msg=audit(1372888328.424:3264): avc:  denied  { read } for  pid=1493 comm=slapd name=log.0000000001 dev=dm-0 ino=263969 scontext=unconfined_u:system_r:slapd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file

    Was caused by:
            Missing type enforcement (TE) allow rule.

            You can use audit2allow to generate a loadable module to allow this access.

Checking labeling

It is unlikely a label restore prevents you from starting a service if SELinux is in permissive mode. Also, why the -F switch?

To know if you have to restore the labeling of a directory or file, first find out what context a file or directory is supposed to have:

# matchpathcon /etc/openldap/
/etc/openldap   system_u:object_r:etc_t:s0

Then list its security context:

# ls -ldZ /etc/openldap/
drwxr-xr-x. root root system_u:object_r:etc_t:s0       /etc/openldap//

In this example, no further action is needed.

With regards to your issue, the problem is not labeling per se, but a missing type enforcement rule, i.e., a rule that allows a labeled process to transition from one confined domain to another, or to read files with an specific label, for example.

Creating an SELinux module

You can try to build a module that allows the slapd_t to perform the operations which appeared in the audit.log. It is probable that you need further adjustments in your code. Use audit2allow, and make for this task. All commands are very well documented in their respective manpages. The process will look roughly like this (after copying the relevant messages into audit.txt):

audit2allow -i audit.txt -m slapd -o slapd.te
make -f /usr/share/selinux/devel/Makefile load

Also, check if a bug report for the SELinux policy regarding this issue already exists.

share|improve this answer
    
I used -F because that's what was done in another thread I found. Seems to have changed the owner of some files, which caused the init script to fail. chmod -R ldap:ldap /var/lib/ldap /etc/openldap/slapd.d fixed that part of the problem. –  Brad Mace Jul 5 '13 at 18:16
    
I agree, this looks like a bug, and should be reported as such. –  Michael Hampton Jul 5 '13 at 18:38
    
@MichaelHampton where would the correct place to report this be? CentOS, Redhat, or somewhere else? –  Brad Mace Jul 5 '13 at 19:02
    
I think you can report on CentOS bugzilla. After investigation they will inform you –  ALex_hha Jul 5 '13 at 19:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.