Default installation of Teamviewer on Fedora 24 will not start due to SELinux issues.
# systemctl -a | grep teamviewer
teamviewerd.service loaded inactive dead TeamViewer remote control daemon
# systemctl start teamviewerd.service
Job for teamviewerd.service failed because a fatal signal was delivered to the control process. See "systemctl status teamviewerd.service" and "journalctl -xe" for details.
To fix it you can use SELinux GUI tool:
sealert -b
Or CLI tool:
ausearch -c 'teamviewerd'
Or you can check system logs:
# journalctl -xe
aug 04 14:23:17 fedora setroubleshoot[3240]: SELinux is preventing teamviewerd from using the execmem access on a process. For complete SELinux messages. run sealert -l 7c667284-3d59-4c06-9535-2aed4b8015df
aug 04 14:23:17 fedora python3[3240]: SELinux is preventing teamviewerd from using the execmem access on a process.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that teamviewerd should be allowed execmem access on processes labeled init_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'teamviewerd' --raw | audit2allow -M my-teamviewerd
# semodule -X 300 -i my-teamviewerd.pp
The solution(shown as a hint in sealert and journalctl), which is to run:
# ausearch -c 'teamviewerd' --raw | audit2allow -M my-teamviewerd
# semodule -X 300 -i my-teamviewerd.pp
After that you should be able to start Teamviewer service:
systemctl start teamviewerd.service
[root ~] # systemctl status teamviewerd.service
● teamviewerd.service - TeamViewer remote control daemon
Loaded: loaded (/etc/systemd/system/teamviewerd.service; enabled; vendor preset: disabled)
Active: active (running) since sun 2016-08-04 14:32:45 CEST; 1min 50s ago
Process: 4228 ExecStart=/opt/teamviewer/tv_bin/teamviewerd -d (code=exited, status=0/SUCCESS)
Main PID: 4230 (teamviewerd)
Tasks: 19 (limit: 512)
CGroup: /system.slice/teamviewerd.service
└─4230 /opt/teamviewer/tv_bin/teamviewerd -d
aug 04 14:32:45 fedora systemd[1]: Starting TeamViewer remote control daemon...
aug 04 14:32:45 fedora systemd[1]: teamviewerd.service: PID file /var/run/teamviewerd.pid not readable (yet?) after start: No such file or directory
aug 04 14:32:45 fedora systemd[1]: Started TeamViewer remote control daemon.
Showing posts with label selinux. Show all posts
Showing posts with label selinux. Show all posts
Sunday, August 7, 2016
Wednesday, May 22, 2013
Custom openvpn port with SElinux enabled
Today I had to setup openvpn client connecting to the server on non-standard port.
Having SElinux enabled always make such things more "interesting".
Openvpn service has started up but in the logs I have found following alerts:
May 22 11:26:30 rhs333 setroubleshoot: SELinux is preventing the openvpn (openvpn_t) from connecting to port 5517. For complete SELinux messages. run sealert -l afe57636-f6d8-4df9-b9c3-1f2d25784025
You can find currently allowed ports by running:
# semanage port -l | grep openvpn_port_t
openvpn_port_t tcp 1194, 9997
openvpn_port_t udp 1194
Having SElinux enabled always make such things more "interesting".
Openvpn service has started up but in the logs I have found following alerts:
May 22 11:26:30 rhs333 setroubleshoot: SELinux is preventing the openvpn (openvpn_t) from connecting to port 5517. For complete SELinux messages. run sealert -l afe57636-f6d8-4df9-b9c3-1f2d25784025
You can find currently allowed ports by running:
# semanage port -l | grep openvpn_port_t
openvpn_port_t tcp 1194, 9997
openvpn_port_t udp 1194
Adding non-standard port is easy:
# semanage port -a -t openvpn_port_t -p tcp 5517
Finally restart openvpn service and it should work fine.
Subscribe to:
Posts (Atom)