Bug 784619

Summary:	semanage is sending the wrong kind of audit events
Product:	Red Hat Enterprise Linux 5	Reporter:	Milos Malik <mmalik>
Component:	policycoreutils	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.8	CC:	dwalsh, eparis, mgrepl, sgrubb
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	784121	Environment:
Last Closed:	2013-12-09 14:24:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	784121
Bug Blocks:

Description Milos Malik 2012-01-25 15:12:01 UTC

+++ This bug was initially created as a clone of Bug #784121 +++

Description of problem:
Semanage is sending the wrong kind of audit events. When a user is assigned a new role, an AUDIT_ROLE_ASSIGN event should be sent. When a user has a role removed, an AUDIT_ROLE_REMOVE event should be sent. When a user's process changes roles, like during login, its supposed to issue an AUDIT_USER_ROLE_CHANGE event.

Semanage is only sending AUDIT_USER_ROLE_CHANGE - which is the wrong kind of event.

# rpm -qa policycoreutils\*
policycoreutils-newrole-1.33.12-14.8.el5
policycoreutils-gui-1.33.12-14.8.el5
policycoreutils-1.33.12-14.8.el5

How reproducible:
Always

Steps to Reproduce:
1. semanage user --add -R staff_r test
2. ausearch -m ROLE_ASSIGN --start recent

Comment 1 RHEL Program Management 2012-06-12 01:24:01 UTC

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated in the
current release, Red Hat is unfortunately unable to address this
request at this time. Red Hat invites you to ask your support
representative to propose this request, if appropriate and relevant,
in the next release of Red Hat Enterprise Linux.

Comment 2 Miroslav Grepl 2013-03-19 15:17:16 UTC

Milos,
I would move it on RHEL6 until we get Fedora fix.

Comment 3 Milos Malik 2013-03-21 14:59:55 UTC

No problem.