Bug 2096457

Summary:	Faulty handling of static applications
Product:	Red Hat Enterprise Linux 9	Reporter:	Dalibor Pospíšil <dapospis>
Component:	fapolicyd	Assignee:	Radovan Sroka <rsroka>
Status:	CLOSED ERRATA	QA Contact:	Dalibor Pospíšil <dapospis>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	dapospis, lvrabec, rsroka
Target Milestone:	rc	Keywords:	Triaged, ZStream
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	fapolicyd-1.1-101.el9	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:	2084497
Clones:	2097734 2127866 (view as bug list)		Environment:
Last Closed:	2022-11-15 10:41:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2084497
Bug Blocks:	2097734, 2127866

Description Dalibor Pospíšil 2022-06-13 21:46:35 UTC

+++ This bug was initially created as a clone of Bug #2084497 +++

Fapolicyd does not appear to maintain a complete execution state machine spanning the execution of statically linked executables, and the subsequent execution of further executables by such processes. As a result, fapolicyd does not always update the exe path for a process when the process performing the execve(2)/execveat(2) syscall is statically linked. This may result in rule bypasses due to the wrong subject being applied.

Reproducer(simplified): 
- two static apps
- first one in trusted
- the first one executed the second one
- the second one should be blocked
- All of the second app’s attributes (as seen in debug mode or syslog) should match it and not it’s parent: exe, comm, pid, etc.



ACs:
* fapolicyd correctly blocks untrusted apps executed via a trusted statically linked app
* all trusted apps are allowed
* all untrusted apps are denied

Comment 16 errata-xmlrpc 2022-11-15 10:41:03 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (fapolicyd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8236