Bug 1036143 - SELinux prevents logwatch from reading /etc/mdadm.conf file
Summary: SELinux prevents logwatch from reading /etc/mdadm.conf file
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-11-29 14:45 UTC by Milos Malik
Modified: 2015-02-18 15:56 UTC (History)
0 users

Fixed In Version: selinux-policy-3.12.1-109.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-13 10:55:09 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Milos Malik 2013-11-29 14:45:52 UTC
Description of problem:
The /etc/mdadm.conf file got a new label and this is a consequence.

Version-Release number of selected component (if applicable):
logwatch-7.4.0-27.20130522svn140.el7.noarch
selinux-policy-3.12.1-105.el7.noarch
selinux-policy-devel-3.12.1-105.el7.noarch
selinux-policy-doc-3.12.1-105.el7.noarch
selinux-policy-minimum-3.12.1-105.el7.noarch
selinux-policy-mls-3.12.1-105.el7.noarch
selinux-policy-targeted-3.12.1-105.el7.noarch

How reproducible:
persuade crond to run /etc/cron.daily/0logwatch

Actual results (enforcing mode):
----
type=PATH msg=audit(11/29/2013 12:06:04.430:693) : item=0 name=/etc/mdadm.conf inode=10110576 dev=fd:03 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:mdadm_conf_t:s0 objtype=NORMAL 
type=CWD msg=audit(11/29/2013 12:06:04.430:693) :  cwd=/ 
type=SYSCALL msg=audit(11/29/2013 12:06:04.430:693) : arch=x86_64 syscall=open success=no exit=-13(Permission denied) a0=0x112bd30 a1=O_RDONLY a2=0x1b6 a3=0x0 items=1 ppid=12819 pid=12821 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=23 comm=perl exe=/usr/bin/perl subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(11/29/2013 12:06:04.430:693) : avc:  denied  { read } for  pid=12821 comm=perl name=mdadm.conf dev="vda3" ino=10110576 scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:mdadm_conf_t:s0 tclass=file 
----

Expected results:
 * no AVCs

Comment 1 Miroslav Grepl 2013-12-04 18:46:45 UTC
We are getting it also on Fedora.

Comment 2 Miroslav Grepl 2013-12-06 10:42:57 UTC
commit 47a899da4cc0019c6e292013217e63fd4ba4fadd
Author: Miroslav Grepl <mgrepl>
Date:   Fri Dec 6 11:42:20 2013 +0100

    Allow logwatch read madm.conf to support RAID setup

Comment 4 Ludek Smid 2014-06-13 10:55:09 UTC
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.


Note You need to log in before you can comment on or make changes to this bug.