Bug 1167201

Summary:	virt-who runs as unconfined_service_t
Product:	Red Hat Enterprise Linux 7	Reporter:	Miroslav Grepl <mgrepl>
Component:	virt-who	Assignee:	Radek Novacek <rnovacek>
Status:	CLOSED NOTABUG	QA Contact:	John Sefler <jsefler>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.1	CC:	lvrabec, mgrepl, mmalik, ovasik, pkis, plautrba, pvrabec, qe-baseos-security
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1166537	Environment:
Last Closed:	2014-11-24 09:26:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1166537
Bug Blocks:	1061797

Description Miroslav Grepl 2014-11-24 08:13:24 UTC

+++ This bug was initially created as a clone of Bug #1166537 +++

Description of problem:

# rpm -ql virt-who |grep -e systemd -e bin | xargs ls -Z
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/bin/virt-who
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/bin/virt-who-password
-rw-r--r--. root root system_u:object_r:virtd_unit_file_t:s0 /usr/lib/systemd/system/virt-who.service
#
# systemctl start virt-who
# systemctl status virt-who
virt-who.service - Daemon for reporting virtual guest IDs to subscription-manager
   Loaded: loaded (/usr/lib/systemd/system/virt-who.service; disabled)
   Active: active (running) since Fri 2014-11-21 09:07:18 CET; 3s ago
 Main PID: 16134 (python)
   CGroup: /system.slice/virt-who.service
           └─16134 /usr/bin/python /usr/share/virt-who/virtwho.py
#
# ps -efZ |grep virt-who
system_u:system_r:unconfined_service_t:s0 root 16134 1  4 09:07 ?      00:00:01 /usr/bin/python /usr/share/virt-who/virtwho.py


Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-9.el7.noarch

How reproducible:
always

--- Additional comment from Miroslav Grepl on 2014-11-21 04:32:20 EST ---

Could you label them as virtd_exec_t? It should work.

# chcon -t virtd_exec_t /usr/share/virt-who/virtwho.py

--- Additional comment from Patrik Kis on 2014-11-21 05:53:23 EST ---

(In reply to Miroslav Grepl from comment #1)
> Could you label them as virtd_exec_t? It should work.
> 
> # chcon -t virtd_exec_t /usr/share/virt-who/virtwho.py

Does not really help:

# ls -Z /usr/share/virt-who/virtwho.py
-rw-r--r--. root root system_u:object_r:usr_t:s0       /usr/share/virt-who/virtwho.py
# ps -efZ |grep -v grep |grep virt-who
system_u:system_r:unconfined_service_t:s0 root 155680 1  0 05:49 ?       00:00:00 /usr/bin/python /usr/share/virt-who/virtwho.py
#
#
# chcon -t virtd_exec_t /usr/share/virt-who/virtwho.py
# ls -Z /usr/share/virt-who/virtwho.py
-rw-r--r--. root root system_u:object_r:virtd_exec_t:s0 /usr/share/virt-who/virtwho.py
# systemctl restart virt-who
# ps -efZ |grep -v grep |grep virt-who
system_u:system_r:unconfined_service_t:s0 root 155799 1 24 05:52 ?       00:00:00 /usr/bin/python /usr/share/virt-who/virtwho.py

--- Additional comment from Miroslav Grepl on 2014-11-24 03:07:18 EST ---

Yes, because of

/usr/bin/python /usr/share/virt-who/virtwho.py

They will need to add a helper script which will run it. Then we can label this helper script to make it working.

Comment 1 Radek Novacek 2014-11-24 08:35:38 UTC

There is a `/usr/bin/virt-who` script that runs:

exec /usr/bin/python /usr/share/virt-who/virtwho.py "$@"

Would it suffice to label this script as `virtd_exec_t`? Will it affect commandline usage of the program? This script is also started from the virt-who.service unit.

Comment 3 Miroslav Grepl 2014-11-24 09:26:31 UTC

Yes, I overlooked it. Thank you.

I see it

ExecStart=/usr/bin/virt-who