Bug 953602

Summary: openhpid runs as initrc_t
Product: Red Hat Enterprise Linux 7 Reporter: Milos Malik <mmalik>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED CURRENTRELEASE QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.0   
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1000521 (view as bug list) Environment:
Last Closed: 2014-06-13 11:49:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 877026    
Bug Blocks: 848829, 1040970    

Description Milos Malik 2013-04-18 15:31:53 UTC 
Description of problem:


Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.12.1-29.el7.noarch
selinux-policy-devel-3.12.1-29.el7.noarch
selinux-policy-doc-3.12.1-29.el7.noarch
selinux-policy-mls-3.12.1-29.el7.noarch
selinux-policy-minimum-3.12.1-29.el7.noarch
selinux-policy-3.12.1-29.el7.noarch
openhpi-libs-3.2.0-2.el7.x86_64
openhpi-3.2.0-2.el7.x86_64
openhpi-devel-3.2.0-2.el7.x86_64

How reproducible:
always

Steps to Reproduce:
# service openhpid stop
Redirecting to /bin/systemctl stop  openhpid.service
# service openhpid start
Redirecting to /bin/systemctl start  openhpid.service
# ps -efZ | grep initrc_t
system_u:system_r:initrc_t:s0   root      7337     1  0 17:30 ?        00:00:00 /usr/sbin/openhpid -c /etc/openhpi/openhpi.conf
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 7348 1293  0 17:30 pts/0 00:00:00 grep --color=auto initrc_t
#
 
Actual results:
* openhpid runs as initrc_t

Expected results:
* openhpid runs in its own SELinux domain
Comment 1 Milos Malik 2013-07-09 12:28:36 UTC 
No signs of openhpi policy:

# rpm -qa selinux-policy\*
selinux-policy-minimum-3.12.1-59.el7.noarch
selinux-policy-mls-3.12.1-59.el7.noarch
selinux-policy-3.12.1-59.el7.noarch
selinux-policy-doc-3.12.1-59.el7.noarch
selinux-policy-devel-3.12.1-59.el7.noarch
selinux-policy-targeted-3.12.1-59.el7.noarch
# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28
# semanage fcontext -l | grep openhpi
# seinfo -t | grep openhpi
   openhpid_client_packet_t
   openhpid_port_t
   openhpid_server_packet_t
# matchpathcon `which openhpid`
/usr/sbin/openhpid	system_u:object_r:bin_t:s0
#
Comment 2 Miroslav Grepl 2013-07-10 08:39:00 UTC 
You are right.

commit 7b825b25b3cd953d92ebfc567f03589fbe4cc683
Author: Miroslav Grepl <mgrepl>
Date:   Wed Jul 10 10:38:15 2013 +0200

    Activate openhpid policy
Comment 4 Miroslav Grepl 2013-09-03 09:24:28 UTC 
commit 7c01f55ad9d6af76790b1fda78486dae11a0dcea
Author: Miroslav Grepl <mgrepl>
Date:   Tue Sep 3 11:23:51 2013 +0200

    Cleanup openhpid policy
Comment 6 Ludek Smid 2014-06-13 11:49:20 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.