Red Hat Bugzilla – Bug 1131501
Mislabeled file '/var/lock/subsys/rtas_errd' found
Last modified: 2015-07-22 02:29:31 EDT
Description of problem: Mislabeled regular file '/var/lock/subsys/rtas_errd' found. Labeled as 'system_u:object_r:var_lock_t:s0', should be 'system_u:object_r:rtas_errd_var_lock_t:s0'. Version-Release number of selected component (if applicable): librtas-1.3.10-1.el6 RHEL-6.6-20140731.1 How reproducible: Always Steps to Reproduce: 1. Install all packages on a RHEL-6.6 system, RHEL-6.6-20140731.1 2. # matchpathcon /var/lock/subsys/rtas_errd /var/lock/subsys/rtas_errd system_u:object_r:rtas_errd_var_lock_t:s0 3. # restorecon -v /var/lock/subsys/* restorecon reset /var/lock/subsys/rtas_errd context system_u:object_r:var_lock_t:s0->system_u:object_r:rtas_errd_var_lock_t:s0 Actual results: restorecon reset /var/lock/subsys/rtas_errd context system_u:object_r:var_lock_t:s0->system_u:object_r:rtas_errd_var_lock_t:s0 Expected results: Already rtas_errd_var_lock_t At least that is how it looks like after: # restorecon /boot/etc/yaboot.conf
Additional info: # ls -Zl /var/lock/subsys -rw-r--r--. 1 system_u:object_r:var_lock_t:s0 root root 0 Aug 18 12:57 abrt-ccpp -rw-r--r--. 1 system_u:object_r:var_lock_t:s0 root root 0 Aug 18 12:57 abrtd -rw-r--r--. 1 system_u:object_r:var_lock_t:s0 root root 0 Aug 18 12:57 anamon (...too long) 2 files have a more specific context, e.g. rtas_errd_var_lock_t, the rest (29 files) have var_lock_t. Don't the other files deserve a more specific context, too? I am trying to find a way to speed up the process as there are many of them.
There are no transition rules if a initrc_t-labeled process creates the file: # sesearch -s initrc_t -t var_lock_t -c file -T The daemon itself does not create it: # sesearch -s rtas_errd_t -t var_lock_t -c file -T Found 1 semantic te rules: type_transition rtas_errd_t var_lock_t : file rtas_errd_var_lock_t; It is /etc/init.d/rtas_errd who creates it by 'touch'. Solution: either run 'restorecon' from within /etc/init.d/rtas_errd or create the lock file in the daemon.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-1320.html