Bug 1153352

Summary:	tomcat runs as unconfined_service_t even if it is confined
Product:	Red Hat Enterprise Linux 7	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.1	CC:	mmalik
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.13.1-13.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-05 10:46:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Milos Malik 2014-10-15 20:27:07 UTC

Description of problem:
 * tomcat unit file executes a wrapper instead of the server and the wrapper is labeled bin_t

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.13.1-4.el7.noarch
selinux-policy-3.13.1-4.el7.noarch
tomcat-7.0.54-1.el7.noarch

How reproducible:
always

Steps to Reproduce:
# ps -efZ | grep tomcat
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 19076 12359  0 22:25 pts/0 00:00:00 grep --color=auto tomcat
# service tomcat start
Redirecting to /bin/systemctl start  tomcat.service
# ps -efZ | grep tomcat
system_u:system_r:unconfined_service_t:s0 tomcat 19170 1 80 22:25 ?    00:00:01 java -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 19207 12359  0 22:25 pts/0 00:00:00 grep --color=auto tomcat
#

Actual results:
 * the service runs as unconfined_service_t

Expected results:
 * the service runs as tomcat_t again

Comment 1 Miroslav Grepl 2014-10-16 13:36:08 UTC

Does it work at all if you label the wrapper correctly?

Comment 2 Milos Malik 2014-10-16 19:24:10 UTC

# grep "Exec.*=" /usr/lib/systemd/system/tomcat.service 
ExecStart=/usr/libexec/tomcat/server start
ExecStop=/usr/libexec/tomcat/server stop
# matchpathcon /usr/libexec/tomcat/server 
/usr/libexec/tomcat/server	system_u:object_r:bin_t:s0
# chcon -t tomcat_exec_t /usr/libexec/tomcat/server
# ps -efZ | grep tomcat
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2580 2347  0 21:23 pts/0 00:00:00 grep --color=auto tomcat
# service tomcat start
Redirecting to /bin/systemctl start  tomcat.service
# ps -efZ | grep tomcat
system_u:system_r:tomcat_t:s0   tomcat    2593     1 37 21:23 ?        00:00:01 java -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2628 2347  0 21:23 pts/0 00:00:00 grep --color=auto tomcat
#

Yes, it does.

Comment 3 Miroslav Grepl 2014-12-02 13:37:38 UTC

commit 0573f1f628fe6e4f384b9fedd5768b3c44cbb5fb
Author: Miroslav Grepl <mgrepl>
Date:   Tue Dec 2 14:37:10 2014 +0100

    Label /usr/libexec/tomcat/server as tomcat_exec_t.

Comment 7 errata-xmlrpc 2015-03-05 10:46:03 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-0458.html