Login or Register to Ask a Question and Join Our Community


Red Hat

SE Linux write permission denied

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems Linux Red Hat SE Linux write permission denied
# 1  
Old 10-12-2015
SE Linux write permission denied
Hi,

In my server I am getting below errors in "/var/log/messages":
Code:
Oct  8 14:45:44 LKOGOMEEMM01 kernel: type=1400 audit(1444295744.792:15818): avc:  denied  { write } for  pid=53421 comm="ip" path="/var/VRTSvcs/log/tmp/IPMultiNIC-8" dev=dm-0 ino=2754879 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file

When I checked the directory "/var/VRTSvcs/log/tmp/"
Code:
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-1
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-0
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-8
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-7
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-6
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-5
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-4
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-3
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-2
-rw-------. 1 root root  0 Aug 22 05:42 IPMultiNIC-9

I couldn't find any problem. One small observation that I could make is that in this problematic server file permission have a "." at end of each file permission "-rw-------." which is not there in any other server.

Thanks in advance.

//BR
Last edited by Franklin52; 10-12-2015 at 11:53 AM.. Reason: Please use code tags
# 2  
Old 10-13-2015
That . (dot) at the end of the display of the discretionary access control (DAC) permissions means that the file has SELinux security context.
You may display the mandatory access control (MAC) permissions of SELinux by using the -Z (capital Z) as in ls -Z

The issue you are experiencing is due to the label context of application ip with SELinux security label context of ifconfig_t trying to write to files /var/VRTSvcs/log/tmp/IPMultiNIC-* with SELinux security label context of var_t. This is exactly what SELinux is supposed to do; deny access to mismatched targets. You might need to investigate a bit about SELinux if you what to fix it.
This User Gave Thanks to Aia For This Post:
rochitsharma
# 3  
Old 10-14-2015
Hi Aia,

Thanks for your reply. I used ls -Z on two of my servers. Following is the output:

Output in the problematic server:
Code:
# ls -Z IPMultiNIC-*
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-0
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-1
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-2
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-3
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-4
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-5
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-6
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-7
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-8
-rw-------. root root system_u:object_r:var_t:s0       IPMultiNIC-9


Output in the healthy Server:
Code:
ls -Z IPMultiNIC-*
-rw------- root root ?                                IPMultiNIC-0
-rw------- root root ?                                IPMultiNIC-1
-rw------- root root ?                                IPMultiNIC-2
-rw------- root root ?                                IPMultiNIC-3
-rw------- root root ?                                IPMultiNIC-4
-rw------- root root ?                                IPMultiNIC-5
-rw------- root root ?                                IPMultiNIC-6
-rw------- root root ?                                IPMultiNIC-7
-rw------- root root ?                                IPMultiNIC-8
-rw------- root root ?                                IPMultiNIC-9

Can you help me fixing the issue by making the permission in problematic server same as healthy server.

Thanks in advance.

//BR
# 4  
Old 10-14-2015
You can remove the SELINUX context for these files using
Code:
semanage fcontext -d

Read up about this command before using it.
# 5  
Old 10-15-2015
Quote:
Originally Posted by rochitsharma
Output in the healthy Server:
Code:
ls -Z IPMultiNIC-*
-rw------- root root ?                                IPMultiNIC-0
-rw------- root root ?                                IPMultiNIC-1
-rw------- root root ?                                IPMultiNIC-2
-rw------- root root ?                                IPMultiNIC-3
-rw------- root root ?                                IPMultiNIC-4
-rw------- root root ?                                IPMultiNIC-5
-rw------- root root ?                                IPMultiNIC-6
-rw------- root root ?                                IPMultiNIC-7
-rw------- root root ?                                IPMultiNIC-8
-rw------- root root ?                                IPMultiNIC-9

Can you help me fixing the issue by making the permission in problematic server same as healthy server.

Thanks in advance.

//BR
The issue has been dealt away in your "healthy server" by disabling SeLinux, completely. New files created after that, do not get any SELinux file context and that's why they show without a . (dot) at the end of the normal Linux permissions and a ? shows instead of the SElinux context.
Security is not convenient and unfortunately it is easier to choose the path of less resistance; in this case disabling SELinux, instead of learning the way that it could be an asset to secure the server.

---------- Post updated 10-15-15 at 08:44 AM ---------- Previous update was 10-14-15 at 10:35 AM ----------

Test this solution based on what you have posted so far.

Install policycoreutils-python if you do not have it yet, from the official repository (it is not installed by default with rhel). This package contains semanage which you'll need to manage SELinux.

Then try:
Code:
semanage fcontext -a -t tmp_t "/var/VRTSvcs/log/tmp(/.*)?"
restorecon -Rv /var/VRTSvcs/log/tmp

That would set anything in /var/VRTSvcs/log/tmp to have a file context of tmp_t which is one of the file context that the process ifconfig_t type is allow to use.
Last edited by Aia; 10-15-2015 at 01:13 PM.. Reason: corrects grammar
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Linux sftp — how to add new user to access exist directory with write permission?

I have built a website and I can access and edit the website'files on server via the root user. The current file and directory structures are not changeable. Now I am hiring a webpage designer to help me re-design some pages, I am going to let the designer edit the files directly on the server. So... (5 Replies)
Discussion started by: uwo-g-xw
5 Replies

2. UNIX for Advanced & Expert Users

Showing "permission denied" when trying to login in - Montavista Linux

Hello friends, I have scratched my system and after that when I am trying to access the console via root login it's failing with an error message of "permission denied". I am able to access the other login, I am having only problem with root and some other user login. I am using an telnet... (7 Replies)
Discussion started by: sanoop
7 Replies

3. Linux

Showing "permission denied" when trying to login in - Montavista Linux

Hello friends, I have scratched my system and after that when I am trying to access the console via root login it's failing with an error message of "permission denied". I am able to access the other login, I am having only problem with root and some other user login. I am using an telnet... (2 Replies)
Discussion started by: sanoop
2 Replies

4. Shell Programming and Scripting

Permission denied

I created a user so that when he logs in he will be directed to a menu /etc/passwd user1:x:115:1:Support -SysAd:/export/home/user1:/export/home/suppotrmenu/script.sh However when I logged in remotely from another server by ssh user1@1.1.1.1 , it saysexport/home/suppotrmenu/script.sh:... (4 Replies)
Discussion started by: lhareigh890
4 Replies

5. Red Hat

Permission denied

Hi guys im new to this db i have a small prob while installing websphereportal6.1i think i was installed succesfully but the error im getting is while starting server. check this out # ./serverStatus.sh -all Error loading: /usr/wps61/AppServer/java/jre/bin/classic/libjvm.so: cannot... (1 Reply)
Discussion started by: varma917989
1 Replies

6. UNIX for Dummies Questions & Answers

Permission denied

I would like to copy data from local mechine to cluster. Basically, I typed scp -r DVD/ acount@cluster:/ it shows Permission denied. Could anyone please give me a clue to write permission on cluster, please? The poperty of where on cluster I'd like to put is drwxr-xr-x Any idea would... (1 Reply)
Discussion started by: su_in99
1 Replies

7. UNIX for Dummies Questions & Answers

Why do I keep getting .:Permission denied?

I'll start off by saying that I know very little about Unix - however, I do know that I have a .profile file in my home directory, and that I should be able to invoke it by typing . profile. However, when I do this for ANY .filename, I get ".: Permission denied". I'm pretty sure that there is... (12 Replies)
Discussion started by: bbersani
12 Replies

8. UNIX for Advanced & Expert Users

Permission denied

Hi, I can not execute a .env file $ . /Data/oracle/d03/mydbora/8.0.6/MYDB.env -bash: /Data/oracle/d03/mydbora/8.0.6/MYDB.env: Permission denied Even if : -rwxrwxrwx 1 oracle dba 2903 Mar 5 2007 /Data/oracle/d03/mydbora/8.0.6/MYDB.env Please help. Many thanks. (1 Reply)
Discussion started by: big123456
1 Replies

9. UNIX for Dummies Questions & Answers

Permission Denied

I just started computer science at UW Milwaukee. When I access the university Solaris system from PuTTY, I get permission denied when I try to access the file I wrote. Now I really have no idea what I'm doing, I just don't understand why I get permission denied in my won directory. Thank You ... (0 Replies)
Discussion started by: howeezy
0 Replies

10. UNIX for Dummies Questions & Answers

permission denied??

i'm trying to set up my internet connection and i was told i need to edit the file /etc/ppp/pap-secrets but i get a permission denied message...why?? (6 Replies)
Discussion started by: justchillin
6 Replies
Login or Register to Ask a Question