[Openswan Users] Pluto has conflict with SeLinux

[Paul Wouters]

On Tue, 16 Sep 2008, OCG Technical Support wrote:

> I'm trying to run IPSec on a system with SeLinux on it.  It appears that
> Pluto has a problem I can't get past (I add local policies for this AVC
> below but doesn't solve the problem):
>
> host=firewall.ocg.ca type=AVC msg=audit(1221407602.428:4482): avc: denied {
> bind } for pid=24677 comm="pluto" scontext=unconfined_u:system_r:ipsec_t:s0
> tcontext=unconfined_u:system_r:ipsec_t:s0 tclass=netlink_xfrm_socket
>
> Any ideas?  Has anyone written a local policy for Pluto that works?

Try the latest rhel/fedora packages and selinux policies?

I am not sure why pluto cannot access ipsec_t or netlink_xfrm_socket.
I'm pretty sure it was able to do so in the past on RHEL/Fedora.

Paul