Bug 853337

Summary:	dmeventd runs as initrc_t
Product:	Red Hat Enterprise Linux 7	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.0	CC:	mgrepl
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.11.1-38.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-06-13 10:48:35 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	877026
Bug Blocks:	848829

Description Milos Malik 2012-08-31 06:51:30 UTC

Description of problem:


Version-Release number of selected component (if applicable):
device-mapper-event-1.02.76-1.el7.x86_64
selinux-policy-3.11.1-11.el7.noarch
selinux-policy-devel-3.11.1-11.el7.noarch
selinux-policy-targeted-3.11.1-11.el7.noarch
selinux-policy-minimum-3.11.1-11.el7.noarch
selinux-policy-doc-3.11.1-11.el7.noarch

How reproducible:
always

Steps to Reproduce:
# run_init service dm-event status
Authenticating root.
Password: 
Redirecting to /bin/systemctl status  dm-event.service
dm-event.service - Device-mapper event daemon
	  Loaded: loaded (/usr/lib/systemd/system/dm-event.service; disabled)
	  Active: inactive (dead) since Fri, 31 Aug 2012 08:49:42 +0200; 13s ago
	    Docs: man:dmeventd(8)
	 Process: 10601 ExecStart=/usr/sbin/dmeventd (code=exited, status=0/SUCCESS)
	Main PID: 10602 (code=exited, status=0/SUCCESS)
	  CGroup: name=systemd:/system/dm-event.service

Aug 31 08:20:09 dhcp-24-118.brq.redhat.com dmeventd[10602]: dmeventd ready fo...
# run_init service dm-event start
Authenticating root.
Password: 
Redirecting to /bin/systemctl start  dm-event.service
# run_init service dm-event status
Authenticating root.
Password: 
Redirecting to /bin/systemctl status  dm-event.service
dm-event.service - Device-mapper event daemon
	  Loaded: loaded (/usr/lib/systemd/system/dm-event.service; disabled)
	  Active: active (running) since Fri, 31 Aug 2012 08:50:05 +0200; 6s ago
	    Docs: man:dmeventd(8)
	 Process: 11040 ExecStart=/usr/sbin/dmeventd (code=exited, status=0/SUCCESS)
	Main PID: 11041 (dmeventd)
	  CGroup: name=systemd:/system/dm-event.service
		  └ 11041 /usr/sbin/dmeventd

Aug 31 08:50:05 dhcp-24-118.brq.redhat.com dmeventd[11041]: dmeventd ready fo...
# ps -efZ | grep eventd
system_u:system_r:initrc_t:s0   root     11041     1  0 08:50 ?        00:00:00 /usr/sbin/dmeventd
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 11054 10941  0 08:50 pts/0 00:00:00 grep --color=auto eventd
#
  
Actual results:
 * dmeventd runs as initrc_t

Expected results:
 * dmeventd runs in its own SELinux domain

Comment 1 Daniel Walsh 2012-09-07 04:12:18 UTC

If you label it lvm_exec_t, does it run ok?

Comment 2 Miroslav Grepl 2012-09-07 08:34:30 UTC

I believe this is a good label for this.

Comment 3 Milos Malik 2012-09-07 10:10:00 UTC

I don't see any AVCs when dmeventd is labelled lvm_exec_t.

Comment 4 Daniel Walsh 2012-10-12 20:36:07 UTC

Fixed in selinux-policy-3.11.1-38.el7

Comment 6 Ludek Smid 2014-06-13 10:48:35 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.