Bug 848804

Summary:	tgtd runs as initrc_t
Product:	Red Hat Enterprise Linux 5	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	5.9	CC:	dwalsh
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-08-20 08:40:12 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	848708

Description Milos Malik 2012-08-16 12:49:22 UTC

Description of problem:


Version-Release number of selected component (if applicable):
selinux-policy-minimum-2.4.6-331.el5
selinux-policy-devel-2.4.6-331.el5
selinux-policy-targeted-2.4.6-331.el5
selinux-policy-2.4.6-331.el5
selinux-policy-strict-2.4.6-331.el5
selinux-policy-mls-2.4.6-331.el5
scsi-target-utils-1.0.14-2.el5

How reproducible:
always

Steps to Reproduce:
# run_init service tgtd status
Authenticating root.
Password: 
tgtd is stopped
# run_init service tgtd start
Authenticating root.
Password: 
Starting SCSI target daemon: Starting target framework daemon

# ps -efZ | grep tgtd
user_u:system_r:initrc_t        root     23211     1  0 14:48 ?        00:00:00 tgtd
user_u:system_r:initrc_t        root     23212 23211  0 14:48 ?        00:00:00 tgtd
root:system_r:unconfined_t:SystemLow-SystemHigh root 23223 2823  0 14:48 pts/0 00:00:00 grep tgtd
#
  
Actual results:
 * tgtd runs as initrc_t

Expected results:
 * tgtd runs in its own SELinux domain

Comment 1 Miroslav Grepl 2012-08-20 08:40:12 UTC

I believe we should stay with initrc_t for all these services for RHEL5. 

Basically I can backport policies but we would need to make this policy as unconfined.

Also we don't see any issues with these services running as initrc.