SELINUX blocks radius but not when using radiusd -X (debug)
Hi, Could anyone explain why this is happening? I just spent like 3 hours trying to figure this out, and I feel like it just doesn't make much sense. On the RADIUS server, SELinux is ON. I start radius in Debug with "radiusd -X" and from my client I login with my RADIUS credentials(really..ldap creds) and it works. No problem. I stop radiusd in debug, and run a 'service radiusd start'. I try to login again and it fails! I then disable SELinux (setenforce 0) and try again and it works. Why does SElinux not block 'radiusd -X' but it seems to block radius when it's started as a service(service radiusd start). What is the difference? Mike Mike
Michael Monette wrote:
Why does SElinux not block 'radiusd -X' but it seems to block radius when it's started as a service(service radiusd start).
What is the difference?
Debug mode is running as you. You have permissions to do things. Daemon mode is running as a "radiusd" or "freeradius" user. It doesn't have permission to do anything. Alan DeKok.
On 17 Apr 2014, at 21:38, Michael Monette <mmonette@2keys.ca> wrote:
I start radius in Debug with "radiusd -X" and from my client I login with my RADIUS credentials(really..ldap creds) and it works. No problem.
Running as root.
I stop radiusd in debug, and run a 'service radiusd start'. I try to login again and it fails!
Running as radiusd. If you're running something redhat based, install policycoreutils-python, and have a read through the output of: # audit2allow -a -w Something may be incorrectly tagged (look at the man page for chcon), or you may need to write a bit of policy. Regards, Adam Bishop gpg: 0x6609D460 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
This is how selinux works. Transition rules are dependent on current type and type of executed binary. In refpolicy-derived installs most daemon transitions depend on a source type of initrc_t i.e. started by an init script. There's plenty of info on this on the web in particular see: http://danwalsh.livejournal.com/23944.html The rest of the blog is good selinux info too. -- Sent from my phone with, please excuse brevity and typos
participants (4)
-
Adam Bishop -
Alan DeKok -
Michael Monette -
Phil Mayers