Bug 1082640

Summary:	chown capability for dhcpd_t
Product:	Red Hat Enterprise Linux 6	Reporter:	Jiri Popelka <jpopelka>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.5	CC:	dwalsh, lvrabec, mgrepl, mmalik, ovasik
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.7.19-236.el6	Doc Type:	Bug Fix
Doc Text:	Cause: Starting, Restarting dhcpd daemon. Consequence: Dhcp daemon needs to change file ownership on a system and selinux denied it. Fix: Allow dhcp daemon to change file ownership on a system in selinux policy (Added chown capability). Result: Now dhcp daemon can change file ownership on a system	Story Points:	---
Clone Of:	867291	Environment:
Last Closed:	2014-10-14 08:01:37 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1067142, 1158941

Description Jiri Popelka 2014-03-31 14:30:26 UTC

+++ This bug was initially created as a clone of Bug #867291 +++

Hi,

would it be possible to have chown capability for dhcpd_t.

Reason:
dhcpd is de-rooting (changing effective user/group ID) itself during start, but before doing it it creates /var/lib/dhcpd/*.leases file. The leases file can't be created after de-rooting because of bug #765967.
In selinux-policy-3.10.0-72.fc16 dhcpd got dac_override to be able to create root:root owned files in /var/lib/dhcpd, which is owned by dhcpd:dhcpd.
Because we need the leases file to be also dhcpd:dhcpd owned the reporter of bug #866714 suggested to chown them after creating, which seems to work but we need to tweak the SELinux policy, see bug #866714, comment #11.

--- Additional comment from Miroslav Grepl on 2012-10-17 16:33:39 CEST ---

Added to -40.fc18

Comment 1 Jiri Popelka 2014-03-31 14:31:21 UTC

We need the same change in RHEL6, so we can fix bug #1067142.

Comment 2 Lukas Vrabec 2014-04-29 15:29:58 UTC

patch sent to Miroslav.

Comment 3 Lukas Vrabec 2014-05-02 12:23:38 UTC

commit 30d7c568dcf280caa308292bdc8f00eff9b29eab
Author: Lukas Vrabec <lvrabec>
Date:   Tue Apr 29 12:16:30 2014 +0200

    Added chown capability to dhcpd_t domain

Comment 6 errata-xmlrpc 2014-10-14 08:01:37 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1568.html

Comment 7 Miroslav Grepl 2015-02-25 13:16:03 UTC

*** Bug 1161537 has been marked as a duplicate of this bug. ***