Bug 2031065

Summary:	Confined users mapped to "sysadm_u" cannot execute "systemd-run" command
Product:	Red Hat Enterprise Linux 8	Reporter:	Renaud Métrich <rmetrich>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.5	CC:	lvrabec, mmalik, ssekidde
Target Milestone:	rc	Keywords:	Triaged
Target Release:	8.6
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.14.3-87.el8	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-10 15:15:45 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1778780

Description Renaud Métrich 2021-12-10 12:37:29 UTC

Description of problem:

"systemd-run" is a convenient way to start a transient service or scope. Unfortunately confined users to "sysadm_u" cannot execute such commands, as shown in the example below:

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
$ sudo -i
# id -Z
sysadm_u:sysadm_r:sysadm_t:s0-s0:c0.c1023

# systemd-run sleep 3600
Failed to start transient service unit: Access denied
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

The reason for this is lacking the init_start() (to be able to start systemd in the container) and init_stop() (to be able to stop the container) rules:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
init_start(sysadm_t)
init_stop(sysadm_t)
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

With the 2 rules:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# systemd-run sleep 3600
Running as unit: run-r67968374b18a4ddfae2fbe076fa2242d.service

# systemctl stop run-r67968374b18a4ddfae2fbe076fa2242d.service 
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------


Version-Release number of selected component (if applicable):

selinux-policy-3.14.3-80.el8.noarch


How reproducible:

Always, see above.

Comment 2 Zdenek Pytela 2022-01-17 15:55:20 UTC

To backport:
commit 489674d8ad8253a18cf88425f2fe3dbf265d03a1 (HEAD -> rawhide, upstream/rawhide)
Author: Zdenek Pytela <zpytela>
Date:   Mon Jan 17 12:44:10 2022 +0100

    Allow sysadm_t start and stop transient services

Comment 16 errata-xmlrpc 2022-05-10 15:15:45 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:1995