Hide Forgot
Description of problem: When rhn_check initiates reboot, shutdown.pid file is created with incorrect SELinux context Version-Release number of selected component (if applicable): rhn-client-tools-1.0.0.1-8.el6.noarch selinux-policy-targeted-3.7.19-195.el6_4.12.noarch upstart-0.6.5-12.el6_4.1.x86_64 How reproducible: always Steps to Reproduce: 1. Use Satellite to initiate remote reboot on the system 2. # rhn_check 3. # ls -alZ /var/run/shutdown.pid -rw-r--r--. root root unconfined_u:object_r:rpm_var_run_t:s0 /var/run/shutdown.pid 4. # ps axZ | grep shutdown unconfined_u:system_r:rpm_t:s0-s0:c0.c1023 29597 pts/0 S 0:00 /sbin/shutdown -r +3 unconfined_u:system_r:rpm_t:s0-s0:c0.c1023 29598 pts/0 Z 0:00 [shutdown] <defunct> 5. # shutdown -c shutdown: Shutdown is not running Actual results: You can not stop shutdown initiated by Satellite/rhn_check with `shutdown -c`. Workaround is easy though: `killall shutdown`. Expected results: You should be able to stop shutdown initiated by Satellite/rhn_check with `shutdown -c`. Additional info: IMO not a 560 blocker. Maybe this is shutdown or SELinux policy issue?
This does not happen on RHEL5. rhn-client-tools-0.4.20.1-6.el5 selinux-policy-targeted-2.4.6-346.el5 SysVinit-2.86-17.el5
Is this a regression from RHEL-6.3?
No, using RHEL-6.3 I see the same: upstart-0.6.5-12.el6.x86_64 # ls -alZ /var/run/shutdown.pid -rw-r--r--. root root unconfined_u:object_r:rpm_var_run_t:s0 /var/run/shutdown.pid # ps axZ | grep shutdown unconfined_u:system_r:rpm_t:s0-s0:c0.c1023 14032 pts/0 S 0:00 /sbin/shutdown -r +3 unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 14036 pts/0 S+ 0:00 grep shutdown # shutdown -c shutdown: Cannot find pid of running shutdown
All right, I'm postponing this to RHEL-6.6
This would be better handled as selinux-policy.
Milos, could you re-test it with $cat mypol.te policy_module(mypol, 1.0) require{ type rpm_t; } shutdown_domtrans(rpm_t)
I'm not familiar with Satellite, but Jan can test it, right?
commit 4ca661aa4513877395986c692da350e57fa5b04c Author: Miroslav Grepl <mgrepl> Date: Sun Apr 12 11:46:28 2015 +0200 Allow rhn_check running as rpm to domtrans to shutdown domain
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-1375.html