OpenVPN up directive not working

Question

I'm having trouble setting up OpenVPN on my server running CentOS 6.2. I have used OpenVPN on this server before and it worked (although that was with Ubuntu, now I'm using CentOS). I just reformatted the hard drive and am trying to get OpenVPN up and running again. I use the up and down directives in my OpenVPN config file to setup my bridge. For some reason when the up script runs, I get a permission denied error when trying to execute brctl. Here's my config file:

mode server
tls-server

local 192.168.1.93 ##ip of server
port 1194
proto tcp

dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"

persist-key
persist-tun

ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
#tls-auth ta.key 0

cipher BF-CBC
comp-lzo

ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.93 255.255.255.0 192.168.1.110 192.168.1.120
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option DOMAIN nyc.rr.com"
max-clients 10

user nobody
group nogroup
keepalive 10 120
status openvpn-status.log
verb 3

And here's the up.sh script:

#!/bin/sh

BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/usr/sbin/brctl addif $BR $DEV

brctl works fine outside of this script. I'm able to execute it manually.

I start OpenVPN as root, so I don't think permissions in the issue, so that's why I'm so confused.

Thanks for any help.

EDIT: Here's the error that's echoed:

[root@server openvpn]# /etc/init.d/openvpn start Starting openvpn: /etc/openvpn/up.sh: line 7: /usr/sbin/brctl: Permission denied [FAILED]

Is there anything in `/var/log/messages` or `audit`? Checked `selinux`? — Bart De Vos, Jun 04 '12 at 23:07
This is logged in `messages`: `WARNING: Failed running command (--up/--down): external program exited with error status: 126` — edc1591, Jun 04 '12 at 23:09
Nothing in `audit`. And what do you mean by "checked `selinux`? — edc1591, Jun 04 '12 at 23:10
Error `126` is "not executable". Have you `chmod +x`ed the script? — SmallClanger, Jun 05 '12 at 09:28
Yup, same problem. I also realized I forgot to post the error. I've edited my post. — edc1591, Jun 05 '12 at 23:07

score 1 · Accepted Answer · answered Jun 06 '12 at 04:45

I believe you hit this bug.

Create file openvpnlocal.te:

module openvpnlocal 1.0;
require {
    type openvpn_t;
    type brctl_exec_t;
    class file { read execute open execute_no_trans };
}
#============= openvpn_t ==============
allow openvpn_t brctl_exec_t:file { read execute open execute_no_trans };

Then run:

checkmodule -M -m -o openvpnlocal.mod openvpnlocal.te
semodule_package -o openvpnlocal.pp -m openvpnlocal.mod
semodule -i openvpnlocal.pp

OpenVPN up directive not working

1 Answers1