Bug 1349044

Summary: dhcpd selinux policy doesn't handle on-commit scripts
Product: Red Hat Enterprise Linux 7 Reporter: Lukas Vrabec <lvrabec>
Component: dhcpAssignee: Pavel Zhukov <pzhukov>
Status: CLOSED ERRATA QA Contact: Release Test Team <release-test-team-automation>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.3CC: atragler, emrakova, jikortus, jpopelka, jstodola, jvavra, lvrabec, mbanas, mganisin, mgrepl, mmalik, plautrba, pvrabec, ssekidde, sspans, thozza
Target Milestone: rcKeywords: EasyFix, FastFix
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: dhcp-4.2.5-52.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1301854 Environment:
Last Closed: 2017-08-01 20:38:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1301854    
Bug Blocks: 1330976, 1380362, 1392968    

Comment 14 Marian Ganisin 2017-05-02 12:59:17 UTC 
Well, I'm afraid this can never work as the /etc/dhcp is accessible just to root:

# ls -l -Z -d /etc/dhcp/
drwxr-x---. root root system_u:object_r:dhcp_etc_t:s0  /etc/dhcp/

(in accordance to 0750,root,root from specfile)

but dhcpd is running as dhcpd:dhcpd. Thus having just /etc/dhcp/scripts is insufficient.

For example 'chgrp dhcpd /etc/dhcp' does right thing.

So no, this is not fixed, dhcpd still can not execute anything from '/etc/dhcp/scripts' due to issue described above
Comment 21 errata-xmlrpc 2017-08-01 20:38:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1956