Bug 1521063
| Summary: | udisks2.service is not confined because the udisksd location has changed | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Milos Malik <mmalik> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.5 | CC: | lvrabec, mgrepl, mmalik, mthacker, plautrba, ssekidde |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-10-30 10:01:27 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Is the move to RHEL-7.7 intentional? What about RHEL-7.6? Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3111 |
Description of problem: SELinux policy expects that udisksd location is one of following: # semanage fcontext -l | grep udisksd /lib/udisks2/udisksd regular file system_u:object_r:devicekit_disk_exec_t:s0 /usr/lib/udisks2/udisksd regular file system_u:object_r:devicekit_disk_exec_t:s0 # but in reality udisksd is located: # ls -l /usr/libexec/udisks2/udisksd -rwxr-xr-x. 1 root root 430752 Nov 30 15:27 /usr/libexec/udisks2/udisksd # matchpathcon /usr/libexec/udisks2/udisksd /usr/libexec/udisks2/udisksd system_u:object_r:bin_t:s0 # as a result the udisks2.service runs as unconfined_service_t. Version-Release number of selected component (if applicable): selinux-policy-3.13.1-180.el7.noarch selinux-policy-devel-3.13.1-180.el7.noarch selinux-policy-doc-3.13.1-180.el7.noarch selinux-policy-minimum-3.13.1-180.el7.noarch selinux-policy-mls-3.13.1-180.el7.noarch selinux-policy-sandbox-3.13.1-180.el7.noarch selinux-policy-targeted-3.13.1-180.el7.noarch udisks2-2.7.3-4.el7.x86_64 How reproducible: * always Steps to Reproduce: # service udisks2 status Redirecting to /bin/systemctl status udisks2.service ● udisks2.service - Disk Manager Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled) Active: inactive (dead) since Tue 2017-12-05 18:38:19 CET; 12min ago Docs: man:udisks(8) Process: 8885 ExecStart=/usr/libexec/udisks2/udisksd (code=exited, status=0/SUCCESS) Main PID: 8885 (code=exited, status=0/SUCCESS) Dec 05 18:38:15 pegas75.localdomain systemd[1]: Starting Disk Manager... Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: udisks daemon version 2.7.... Dec 05 18:38:15 pegas75.localdomain systemd[1]: Started Disk Manager. Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: Acquired the name org.free... Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopping Disk Manager... Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopped Disk Manager. Hint: Some lines were ellipsized, use -l to show in full. # service udisks2 start Redirecting to /bin/systemctl start udisks2.service # service udisks2 status Redirecting to /bin/systemctl status udisks2.service ● udisks2.service - Disk Manager Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2017-12-05 18:51:15 CET; 1s ago Docs: man:udisks(8) Main PID: 10235 (udisksd) Tasks: 6 CGroup: /system.slice/udisks2.service └─10235 /usr/libexec/udisks2/udisksd Dec 05 18:51:15 pegas75.localdomain systemd[1]: Starting Disk Manager... Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: udisks daemon version 2.7... Dec 05 18:51:15 pegas75.localdomain systemd[1]: Started Disk Manager. Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: Acquired the name org.fre... Hint: Some lines were ellipsized, use -l to show in full. # ps -efZ | grep udisk system_u:system_r:unconfined_service_t:s0 root 10235 1 0 18:51 ? 00:00:00 /usr/libexec/udisks2/udisksd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 10256 1289 0 18:51 pts/0 00:00:00 grep --color=auto udisk # Actual results: /usr/libexec/udisks2/udisksd is labeled bin_t Expected results: /usr/libexec/udisks2/udisksd is labeled devicekit_disk_exec_t