Bug 119006

Summary:	usernetctl needs to be SELinux-aware
Product:	[Fedora] Fedora	Reporter:	Aleksey Nogin <aleksey>
Component:	initscripts	Assignee:	Bill Nottingham <notting>
Status:	CLOSED RAWHIDE	QA Contact:	Brock Organ <borgan>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	dwalsh, russell, rvokal, sct, wtogami
Target Milestone:	---	Keywords:	SELinux
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-10-03 13:42:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	122683

Description Aleksey Nogin 2004-03-23 20:10:33 UTC

Currently, usernetctl does not make any attempt to cooperate with
SELinux and runs all scripts in the originating context of the caller.
As a result, SELinux would not let ordinary users (or staff_r users
for that matter) to control the USERCTL=yes devices.

initscripts-7.48-1 policy-1.9-6

Comment 1 Aleksey Nogin 2004-03-24 23:33:51 UTC

Update: when running in enforcing mode with policy-1.9-11, the staff_r
can control the USERCTL=yes devices. 

Hopefully we just need to:
- Check that the user_r works too (assuming it is desirable).
- Add dontaudit for messages that get generated.

Comment 2 Bill Nottingham 2005-09-30 21:11:57 UTC

Closing bugs on older releases. Apologies for any lack of response.

Does this persist on FC3/FC4 with strict policy?

Comment 3 Aleksey Nogin 2005-10-02 07:33:49 UTC

I have no idea. I am currently using FC3 with the targeted policy.

Comment 4 Daniel Walsh 2005-10-03 13:42:27 UTC

I will cloase this bug since, NetworkManager should handle this functionality
now and most users are using targeted policy anyways.