Bug 848752

Summary:	isnsd runs as initrc_t
Product:	Red Hat Enterprise Linux 5	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	5.9	CC:	dwalsh
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-08-20 08:40:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	848708

Description Milos Malik 2012-08-16 11:06:52 UTC

Description of problem:


Version-Release number of selected component (if applicable):
selinux-policy-minimum-2.4.6-331.el5
selinux-policy-devel-2.4.6-331.el5
selinux-policy-targeted-2.4.6-331.el5
selinux-policy-2.4.6-331.el5
selinux-policy-strict-2.4.6-331.el5
selinux-policy-mls-2.4.6-331.el5
isns-utils-0.93-1.0.el5

How reproducible:
always

Steps to Reproduce:
# run_init service isnsd status
Authenticating root.
Password: 
isnsd is stopped
# run_init service isnsd start
Authenticating root.
Password: 
Starting iSNS Server:                                      [  OK  ]
# ps -efZ | grep isnsd
user_u:system_r:initrc_t        root     14572     1  0 13:05 ?        00:00:00 isnsd
root:system_r:unconfined_t:SystemLow-SystemHigh root 14575 2823  0 13:05 pts/0 00:00:00 grep isnsd
#
  
Actual results:
* isnsd runs as initrc_t

Expected results:
* isnsd runs in its own SELinux domain

Comment 1 Miroslav Grepl 2012-08-20 08:40:09 UTC

I believe we should stay with initrc_t for all these services for RHEL5. 

Basically I can backport policies but we would need to make this policy as unconfined.

Also we don't see any issues with these services running as initrc.