nscd errors

nscd errors

[Sylviane Molinet]

[-- Attachment #1: Type: text/plain, Size: 1449 bytes --]

Hello,

I've installed redhat ES 4 server with nis authentification. But I have 
following errors in /var/log/messages :
nscd:

Mar 27 09:36:52 nscd: Can't send to audit system: USER_AVC pid=25562 
uid=28 loginuid=-1 message=avc:  denied  { getgrp } for  
scontext=root:system_r:unconfined_t tcontext=root:system_r:initrc_t 
tclass=nscd
Mar 27 09:36:52  nscd: Can't send to audit system: USER_AVC pid=25562 
uid=28 loginuid=-1 message=avc:  denied  { shmempwd } for  
scontext=root:system_r:unconfined_t tcontext=root:system_r:initrc_t 
tclass=nscd
Mar 27 09:36:52 nscd: Can't send to audit system: USER_AVC pid=25562 
uid=28 loginuid=-1 message=avc:  denied  { getpwd } for  
scontext=root:system_r:unconfined_t tcontext=root:system_r:initrc_t 
tclass=nscd

map exported are passwd group and hosts.

The files for these maps aren't located in /etc but in /var/yp/nis.

File /etc/selinux/conf is configured like this :
SELINUX=enforcing
SELINUXTYPE=targeted

When I run fixfiles I get following messages :

fixfiles -R nscd check

/sbin/restorecon:  error while labeling files under /var/run/nscd/group

/sbin/restorecon:  error while labeling files under /var/run/nscd/hosts

/sbin/restorecon:  error while labeling files under /var/run/nscd/passwd

But this files doesn't exist.

Thanks in advance for your help, I apoligized if this question has been asked before but I didn't find this topic in the archive mailing list.


-- 
Sylviane MOLINET


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/x-pkcs7-signature, Size: 2696 bytes --]

Re: nscd errors

[Stephen Smalley]

On Tue, 2007-03-27 at 11:43 +0200, Sylviane Molinet wrote:
> Hello,
> 
> I've installed redhat ES 4 server with nis authentification. But I have 
> following errors in /var/log/messages :
> nscd:
> 
> Mar 27 09:36:52 nscd: Can't send to audit system: USER_AVC pid=25562 
> uid=28 loginuid=-1 message=avc:  denied  { getgrp } for  
> scontext=root:system_r:unconfined_t tcontext=root:system_r:initrc_t 
> tclass=nscd
> Mar 27 09:36:52  nscd: Can't send to audit system: USER_AVC pid=25562 
> uid=28 loginuid=-1 message=avc:  denied  { shmempwd } for  
> scontext=root:system_r:unconfined_t tcontext=root:system_r:initrc_t 
> tclass=nscd
> Mar 27 09:36:52 nscd: Can't send to audit system: USER_AVC pid=25562 
> uid=28 loginuid=-1 message=avc:  denied  { getpwd } for  
> scontext=root:system_r:unconfined_t tcontext=root:system_r:initrc_t 
> tclass=nscd

Not sure that nscd is supposed to be running in initrc_t in RHEL4, but
you can workaround the issue by allowing the above permissions.  You'd
need to install the selinux-policy-targeted-sources and checkpolicy
packages, and then you can use audit2allow.  Some resources that may
help you:
http://fedoraproject.org/wiki/SELinux/
http://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/selinux-guide/index.html

Be aware however that SELinux has changed a lot since RHEL4, so you
can't use newer features like loadable policy modules and semanage there
(they are included in RHEL5).  The Fedora Core 3 SELinux FAQ and the
RHEL4 SELinux guide are likely the most suitable resources for RHEL4
SELinux.

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.