Bug 1213409

Summary:	selinux-policy: Update for abrt changes
Product:	Red Hat Enterprise Linux 7	Reporter:	Florian Weimer <fweimer>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Jan Zarsky <jzarsky>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.3	CC:	fweimer, jzarsky, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.13.1-66.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-04 02:18:34 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1212885, 1213408
Bug Blocks:	1211224, 1214172, 1295396

Description Florian Weimer 2015-04-20 13:47:21 UTC

The root directory for the problem directories will likely move back to /var/spool/abrt, where it was in RHEL 6 (bug 1213408).

If we have a separate crashdump handler which does not write user coredumps, we can restrict write access to problem directories only (bug 1212885).

Comment 2 Miroslav Grepl 2015-08-04 14:52:02 UTC

What is a problem here? Is it still actual?

Comment 3 Florian Weimer 2015-08-04 15:46:12 UTC

See bug 1212885.  A policy update is required once this is implemented.

Right now, abrt-hook-ccpp is not constrained by SELinux at all, and this seems rather difficult to change because it has to write all across the file system.

Comment 5 Florian Weimer 2015-08-24 11:18:21 UTC

(In reply to Miroslav Grepl from comment #4)
> It is RHEL-7.2 material?
> 
> Basically we want to play witb abrt_exec_t labeling for this hook.

I don't think further constraints are possible until the user coredump functionality is split into a separate binary.  As far as I understan the situation, this must happen before it is possible to write a decent policy for abrt-hook-ccpp because right now, this program must be able to create arbitrary files, with arbitrary ownership, in arbitrary directories.

Comment 7 Miroslav Grepl 2016-01-14 09:06:42 UTC

We have in Fedora policy

/usr/libexec/abrt-hook-ccpp     --  gen_context(system_u:object_r:abrt_dump_oops_exec_t,s0)

We need to back port it.

Comment 8 Mike McCune 2016-03-28 22:59:28 UTC

This bug was accidentally moved from POST to MODIFIED via an error in automation, please see mmccune with any questions

Comment 12 errata-xmlrpc 2016-11-04 02:18:34 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html