Bug 876924

Summary: haproxy runs as initrc_t
Product: Red Hat Enterprise Linux 7 Reporter: Milos Malik <mmalik>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED CURRENTRELEASE QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.0CC: bperkins, mgrepl
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-3.12.1-57.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 10:24:11 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 877026    
Bug Blocks: 848829, 1040963    

Description Milos Malik 2012-11-15 10:17:37 UTC 
Description of problem:


Version-Release number of selected component (if applicable):
haproxy-1.4.22-1.el7.x86_64
selinux-policy-3.11.1-51.el7.noarch
selinux-policy-devel-3.11.1-51.el7.noarch
selinux-policy-doc-3.11.1-51.el7.noarch
selinux-policy-minimum-3.11.1-51.el7.noarch
selinux-policy-mls-3.11.1-51.el7.noarch
selinux-policy-targeted-3.11.1-51.el7.noarch

How reproducible:
always

Steps to Reproduce:
# service haproxy restart
Redirecting to /bin/systemctl restart  haproxy.service
# service haproxy status
Redirecting to /bin/systemctl status  haproxy.service
haproxy.service - HAProxy For TCP And HTTP Based Applications
	  Loaded: loaded (/usr/lib/systemd/system/haproxy.service; disabled)
	  Active: active (running) since Thu, 2012-11-15 11:15:22 CET; 6s ago
	 Process: 3045 ExecStart=/usr/sbin/haproxy -D -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid (code=exited, status=0/SUCCESS)
	 Process: 3042 ExecStartPre=/usr/sbin/haproxy -c -q -f /etc/haproxy/haproxy.cfg (code=exited, status=0/SUCCESS)
	Main PID: 3046 (haproxy)
	  CGroup: name=systemd:/system/haproxy.service
		  └ 3046 /usr/sbin/haproxy -D -f /etc/haproxy/haproxy.cfg -...

Nov 15 11:15:22 dhcp-24-118.brq.redhat.com systemd[1]: Started HAProxy For TC...
# ps -efZ | grep haproxy
system_u:system_r:initrc_t:s0   haproxy   3046     1  0 11:15 ?        00:00:00 /usr/sbin/haproxy -D -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 3062 1512  0 11:15 pts/0 00:00:00 grep --color=auto haproxy
#

Actual results:
* haproxy runs as initrc_t

Expected results:
 * haproxy runs in its own SELinux domain
Comment 1 Miroslav Grepl 2013-06-25 12:26:34 UTC 
commit 55130cbd7572990a0a516851e71609e768aaac37
Author: Miroslav Grepl <mgrepl>
Date:   Tue Jun 25 14:25:18 2013 +0200

    A new policy for haproxy and placed it to rhcs.te
Comment 2 Milos Malik 2013-07-17 14:20:56 UTC 
Fixed-In-Version value was taken from the changelog.
Comment 4 Miroslav Grepl 2013-07-22 07:11:30 UTC 
Well, this is caused by broken semanage-port. (has been fixed)

I am adding fixes to the policy.
Comment 6 Ludek Smid 2014-06-13 10:24:11 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.