| Summary: | abrt-watch-log is running as initrc_t | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Miroslav Grepl <mgrepl> |
| Component: | abrt | Assignee: | abrt <abrt-devel-list> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 17 | CC: | abrt-devel-list, dvlasenk, dwalsh, iprikryl, jmoskovc, kklic, mmilata, mtoman, npajkovs |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2012-08-10 05:49:16 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
Why not run abrt_watch_log as logwatch_exec_t. It needs execute abrt_dump_oops_exec_t and I think it will end up as unconfined. Does the policy already exist? Can we close this bug? Yes, we can close it. system_u:system_r:abrt_watch_log_t:s0 674 ? 00:00:00 abrt-watch-log |
Description of problem: $ ps -eZ |grep initrc system_u:system_r:initrc_t:s0 661 ? 00:00:00 abrt-watch-log I created an initial policy an run ausearch+audit2allow #============= abrt_watch_log_exec_t ============== allow abrt_watch_log_exec_t abrt_dump_oops_exec_t:file { read execute open execute_no_trans }; allow abrt_watch_log_exec_t abrt_etc_t:file { read getattr open }; allow abrt_watch_log_exec_t locale_t:file { read getattr open }; allow abrt_watch_log_exec_t var_log_t:file { read open }; I see: abrt-watch-log "This patch splits abrt-dump-oops into a generic log watcher tool, abrt-watch-log, and oops finder, which retains the name abrt-dump-oops" $ abrt-watch-log --help Usage: abrt-watch-log [-vs] [-F STR]... FILE PROG [ARGS] Watch log file FILE, run PROG when it grows or is replaced -v, --verbose Be verbose -s Log to syslog -F STR Don't run PROG if STRs aren't found So it means abrt-watch-log can run whatever? Do I understand correctly?