Bug 190885

Summary: LTC23495-cvs is tagged in a way it can't be used with mls policy
Product: [Fedora] Fedora Reporter: IBM Bug Proxy <bugproxy>
Component: selinux-policy-mlsAssignee: Russell Coker <rcoker>
Status: CLOSED RAWHIDE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: 5CC: dwalsh
Target Milestone: ---   
Target Release: ---   
Hardware: powerpc   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-09-15 16:52:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description IBM Bug Proxy 2006-05-05 22:16:21 UTC
LTC Owner is: dmosby.com
LTC Originator is: krisw.com


Problem description: When CVS is installed it is tagged cvs_exec_t which 
apparently can't be executed in the MLS policy.

       Provide output from "uname -a", if possible:
Linux bladeracer2.ltc.austin.ibm.com 2.6.16-1.2139.2.1_FC6.lspp.18 #1 SMP Wed 
Apr 19 17:26:02 EDT 2006 ppc64 ppc64 ppc64 GNU/Linux

Hardware Environment
    Machine type (p650, x235, SF2, etc.):8842P1Z JS20 blade
    Cpu type (Power4, Power5, IA-64, etc.): Power 4
    Describe any special hardware you think might be relevant to this problem:

Please provide access information for the machine if it is available.

Is this reproducible?
    If so, how long does it (did it) take to reproduce it? 1 minute

The system has FC5 installed and then the configuration script for evaluation 
was run.  If you can't recreate this on a normal installation, contact me for 
more information about where to get this script and how to run it.  
 
Log into the system as a user who is a member of the wheel group, then:
/bin/su -
newrole -r sysadm_r
rpm -i cvs-1.11.21-3.2.ppc.rpm    (Successful)
cvs  (Permission denied)
ls -Z /usr/bin/cvs

-rwxr-xr-x  root  root  system_u:object_r:cvs_exec_t:SystemLow /usr/bin/cvs

chcon system_u:object_r:bin_t:SystemLow /usr/bin/cvs

cvs  (Successful)

Is the system (not just the application) hung?  No
    
Did the system produce an OOPS message on the console?  No

Is the system sitting in a debugger right now?  No

Additional information: /etc/selinux/config had SELINUX=enforcing and
SELINUXTYPE=MLS

Please mirror to Red Hat.

Comment 1 Daniel Walsh 2006-05-09 19:23:46 UTC
Fixed in selinux-policy-2.2.38-2

Comment 2 IBM Bug Proxy 2006-09-15 15:11:20 UTC
changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|TESTED                      |ACCEPTED




------- Additional Comments From krisw.com  2006-09-15 11:07 EDT -------
cvs is now tagged as :cvs_exec_t and works.  Thanks!