Bug 1597214

Summary:	[RFE] goferd runs in unconfined prcoesses
Product:	Red Hat Satellite	Reporter:	Harshad More <hmore>
Component:	katello-agent	Assignee:	satellite6-bugs <satellite6-bugs>
Status:	CLOSED WONTFIX	QA Contact:	Katello QA List <katello-qa-list>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	6.3.1	CC:	anrussel, bkearney, david.ruwoldt
Target Milestone:	Unspecified	Keywords:	FutureFeature, Reopened
Target Release:	Unused
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-02 17:25:56 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Harshad More 2018-07-02 09:28:48 UTC

Description of problem:

goferd service runs on client systems registered to satellite.
The service runs in "unconfined_service_t domain"

Version-Release number of selected component (if applicable):
All

How reproducible:
100%

Steps to Reproduce:
1. register client to satellite and install katello-agent
2. start goferd service
3. ps axZ | grep gofer


Actual results:
system_u:system_r:unconfined_service_t:s0 7236 ? Ssl   0:01 python /usr/bin/goferd --foreground


Expected results:

service should not run in unconfined.

Additional info:

see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/sect-security-enhanced_linux-targeted_policy-unconfined_processes

Comment 3 Bryan Kearney 2018-08-09 17:20:49 UTC

Thank you for your interest in Satellite 6. We have evaluated this request, and we do not expect this to be implemented in the product in the forseeable future. We are therefore closing this out as WONTFIX. If you have any concerns about this, please feel free to contact Rich Jerrido or Bryan Kearney. Thank you.

Comment 4 Bryan Kearney 2018-08-09 17:21:18 UTC

Gofer needs to be unconstrained since it is running arbitrary commands.

Comment 6 Brad Buckingham 2022-11-03 21:48:15 UTC

Upon review of our valid but aging backlog the Satellite Team has concluded that this Bugzilla does not meet the criteria for a resolution in the near term, and are planning to close in a month. This message may be a repeat of a previous update and the bug is again being considered to be closed. If you have any concerns about this, please contact your Red Hat Account team.  Thank you.

Comment 7 Brad Buckingham 2022-12-02 17:25:56 UTC

Thank you for your interest in Red Hat Satellite. We have evaluated this request, and while we recognize that it is a valid request, we do not expect this to be implemented in the product in the foreseeable future. This is due to other priorities for the product, and not a reflection on the request itself. We are therefore closing this out as WONTFIX. If you have any concerns about this feel free to contact your Red Hat Account Team. Thank you.