Bug 1195175
| Summary: | file context patterns for inn* programs are incorrect | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Milos Malik <mmalik> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.1 | CC: | lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.13.1-33.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-19 10:26:51 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
commit a210c13f690fbd7e4c7a4fe202cd17cff1fdbf36
Author: Lukas Vrabec <lvrabec>
Date: Thu Jul 9 17:18:41 2015 +0200
Fix paths in inn policy, Allow innd read innd_log_t dirs, Allow innd execute innd_etc_t files
Milos, please check your tests, there are some bugs(paths).
commit 9d1e36882e367aa6af4f3ab15ac8f97ac00fe4b8
Author: Lukas Vrabec <lvrabec>
Date: Wed Jul 15 10:11:31 2015 +0200
inn daemon should create innd_log_t objects in var_log_t instead of innd_var_run_t
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2300.html |
Description of problem: * file context patterns for inn* programs are incorrect therefore innd runs as unconfined_service_t even if correct contexts exist Version-Release number of selected component (if applicable): inn-2.5.3-18.el7.x86_64 inn-libs-2.5.3-18.el7.x86_64 selinux-policy-3.13.1-23.el7.noarch selinux-policy-devel-3.13.1-23.el7.noarch selinux-policy-doc-3.13.1-23.el7.noarch selinux-policy-minimum-3.13.1-23.el7.noarch selinux-policy-mls-3.13.1-23.el7.noarch selinux-policy-sandbox-3.13.1-23.el7.noarch selinux-policy-targeted-3.13.1-23.el7.noarch How reproducible: always Steps to Reproduce: # matchpathcon /usr/lib/news/bin/innd /usr/lib/news/bin/innd system_u:object_r:innd_exec_t:s0 # ls -l /usr/lib/news/bin/innd ls: cannot access /usr/lib/news/bin/innd: No such file or directory # ls -l /usr/libexec/news/innd -rwxr-xr-x. 1 root news 229304 Jan 15 2014 /usr/libexec/news/innd # matchpathcon /usr/libexec/news/innd /usr/libexec/news/innd system_u:object_r:bin_t:s0 # service innd status Redirecting to /bin/systemctl status innd.service innd.service - Inetnet News Daemon Loaded: loaded (/usr/lib/systemd/system/innd.service; disabled) Active: active (running) since Mon 2015-02-23 11:22:03 CET; 1s ago Process: 21942 ExecStart=/usr/libexec/news/rc.news (code=exited, status=0/SUCCESS) Main PID: 21971 (innd) CGroup: /system.slice/innd.service ├─21971 /usr/libexec/news/innd └─21975 controlchan Feb 23 11:22:03 rhel70.localdomain innd[21971]: SERVER outgoing 1010 Feb 23 11:22:03 rhel70.localdomain innd[21971]: SERVER ccsetup control:12 Feb 23 11:22:03 rhel70.localdomain innd[21971]: SERVER lcsetup localconn:14 Feb 23 11:22:03 rhel70.localdomain innd[21971]: SERVER rcsetup remconn:15 Feb 23 11:22:03 rhel70.localdomain innd[21971]: SERVER rcsetup remconn:17 Feb 23 11:22:03 rhel70.localdomain innd[21971]: controlchan! spawned control...5 Feb 23 11:22:03 rhel70.localdomain systemd[1]: Started Inetnet News Daemon. Feb 23 11:22:03 rhel70.localdomain innd[21971]: SERVER perl filter not defined Feb 23 11:22:03 rhel70.localdomain innd[21971]: SERVER starting Feb 23 11:22:03 rhel70.localdomain controlchan[21975]: starting Hint: Some lines were ellipsized, use -l to show in full. # ps -efZ | grep inn system_u:system_r:unconfined_service_t:s0 news 21971 1 0 11:22 ? 00:00:00 /usr/libexec/news/innd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 21989 5380 0 11:22 pts/0 00:00:00 grep --color=auto inn # Actual results: * innd process runs as unconfined_service_t Expected results: * innd process runs as innd_t