Bug 730218

Summary:	selinux preventing procmail to execute hostname command
Product:	Red Hat Enterprise Linux 6	Reporter:	Karel Srot <ksrot>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	low	Docs Contact:
Priority:	low
Version:	6.1	CC:	dwalsh, mgrepl, mmalik
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.7.19-108.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	730294 (view as bug list)		Environment:
Last Closed:	2011-12-06 10:13:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	730294

Description Karel Srot 2011-08-12 08:02:17 UTC

Description of problem:

I am not sure whether this is a bug or not. The test case for bug 442028
produces following AVCs:

----
time->Thu Aug 11 10:17:34 2011
type=SYSCALL msg=audit(1313072254.344:233414): arch=80000016 syscall=11 per=400000 success=no exit=-13 a0=3fffff7c5f3 a1=8001eb60 a2=8001ec80 a3=200002514c0 items=0 ppid=11957 pid=11958 auid=4294967295 uid=502 gid=503 euid=502 suid=502 fsuid=502 egid=503 sgid=503 fsgid=503 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1313072254.344:233414): avc:  denied  { execute } for  pid=11958 comm="procmail" name="hostname" dev=dm-0 ino=1177374 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
----
time->Thu Aug 11 10:17:34 2011
type=SYSCALL msg=audit(1313072254.344:233415): arch=80000016 syscall=106 per=400000 success=no exit=-13 a0=80103790 a1=3fffff76550 a2=3fffff76550 a3=200001d69b0 items=0 ppid=11957 pid=11958 auid=4294967295 uid=502 gid=503 euid=502 suid=502 fsuid=502 egid=503 sgid=503 fsgid=503 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1313072254.344:233415): avc:  denied  { getattr } for  pid=11958 comm="sh" path="/bin/hostname" dev=dm-0 ino=1177374 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
----
time->Thu Aug 11 10:17:36 2011
type=SYSCALL msg=audit(1313072256.164:233422): arch=80000016 syscall=11 per=400000 success=no exit=-13 a0=8001d2fa a1=8001eb60 a2=8001ec80 a3=200002514c0 items=0 ppid=11993 pid=11994 auid=4294967295 uid=501 gid=502 euid=501 suid=501 fsuid=501 egid=502 sgid=502 fsgid=502 tty=(none) ses=4294967295 comm="procmail" exe="/usr/bin/procmail" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1313072256.164:233422): avc:  denied  { execute } for  pid=11994 comm="procmail" name="hostname" dev=dm-0 ino=1177374 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file
----
time->Thu Aug 11 10:17:36 2011
type=SYSCALL msg=audit(1313072256.164:233423): arch=80000016 syscall=5 per=400000 success=no exit=-13 a0=801036f0 a1=0 a2=3fffff95e46 a3=0 items=0 ppid=11993 pid=11994 auid=4294967295 uid=501 gid=502 euid=501 suid=501 fsuid=501 egid=502 sgid=502 fsgid=502 tty=(none) ses=4294967295 comm="sh" exe="/bin/bash" subj=system_u:system_r:procmail_t:s0 key=(null)
type=AVC msg=audit(1313072256.164:233423): avc:  denied  { read } for  pid=11994 comm="sh" name="hostname" dev=dm-0 ino=1177374 scontext=system_u:system_r:procmail_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file

This is because of procmail recipe which instructs procmail to execute hostname command:

# cat /home/she10779/.procmailrc
PATH=$HOME/bin:/bin:/usr/bin:/usr/local/bin
MAILDIR=$HOME/mail
LOGFILE=$HOME/mail/procmail.log
HOST_NAME=`hostname`

:0:
* ^From:.*he6691@.*$
my-love

I know that this can be avoided using $HOSTNAME instead of `hostname`.
Strange thing is that this happend on s390x platform only, the test passed on other platforms.
I am not sure whether there is any risk in allowing procmail to execute hostname command.


Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-93.el6_1.7

How reproducible:
always

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 2 Karel Srot 2011-08-12 09:22:04 UTC

Oh, now I can see the test should load a custom module to allow it. Switching to RHEL Tests component, the test should be reviewed.

Comment 3 Daniel Walsh 2011-08-12 10:41:53 UTC

Miroslav lets add

application_exec_all(procmail_t)

Comment 4 Karel Srot 2011-08-12 11:39:40 UTC

OK, this is a policy bug, switching back to RHEL6

to QE: RHTS test should be updated to not to load the module.

Comment 6 Miroslav Grepl 2011-08-24 15:32:50 UTC

Fixed in selinux-policy-3.7.19-108.el6

Comment 9 errata-xmlrpc 2011-12-06 10:13:03 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html