Bug 989480

Summary: secalert: glusterfs-fuse: File /usr/bin/fusermount-glusterfs on x86_64 is setuid root but is not on the setxid whitelist
Product: Red Hat Enterprise Linux 6 Reporter: Bala.FA <barumuga>
Component: glusterfsAssignee: Amar Tumballi <amarts>
Status: CLOSED ERRATA QA Contact: Cluster QE <mspqa-list>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 6.5CC: barumuga, dpati, grajaiya, shaines, vraman
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: glusterfs-3.4.0.22rhs-2 Doc Type: Bug Fix
Doc Text:
Cause: errata tool reports security alert for file /usr/bin/fusermount-glusterfs on which setuid bit for root is set, but it is not on the setxid whitelist Consequence: attaching build to errata fails in rpmdiff test Fix: remove setuid bit set for /usr/bin/fusermount-glusterfs Result: now rpmdiff doesn't report failure and the security alert has been removed
Story Points: ---
Clone Of:
: 993270 (view as bug list) Environment:
Last Closed: 2013-11-21 11:58:51 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 993270    

Description Bala.FA 2013-07-29 10:50:24 UTC
errata tool reports secalert for glusterfs-fuse

File /usr/bin/fusermount-glusterfs on x86_64 is setuid root but is not on the setxid whitelist

Comment 1 Amar Tumballi 2013-07-29 18:04:16 UTC
Bala, looks like '/usr/bin/fusermount' from package 'fuse' also has same setxid bits enabled. We just need fusermount-glusterfs to be added to the whitelist then.

-Amar

Comment 2 Amar Tumballi 2013-08-23 18:24:01 UTC
Issue fixed with fixing the modes.

Comment 4 Amar Tumballi 2013-10-09 05:22:04 UTC
Steps to check:

On any glusterfs version (not on RHS or on RHS, before glusterfs-3.4.0.10rhs)
amar@ganaka:~/work/rhs-glusterfs$ ls -l /usr/bin/fusermount-glusterfs
-rwsr-xr-x 1 root root 102192 Oct  5 00:03 /usr/local/bin/fusermount-glusterfs

with latest rhs, you don't see the setuid set on the file. (ie, no 's' in the mode bits).

Comment 5 Gowrishankar Rajaiyan 2013-10-09 06:23:48 UTC
[root@dhcp201-162 ~]# ls -l /usr/bin/fusermount-glusterfs
-rwxr-xr-x. 1 root root 28304 Oct  8 11:35 /usr/bin/fusermount-glusterfs
[root@dhcp201-162 ~]# 

[root@dhcp201-162 ~]# rpm -qf  /usr/bin/fusermount-glusterfs
glusterfs-fuse-3.4.0.34rhs-1.el6.x86_64
[root@dhcp201-162 ~]# 

Verified.

Comment 6 errata-xmlrpc 2013-11-21 11:58:51 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1641.html