Bug 125932 - Accesses /root/.themes and maybe other things under /root
Accesses /root/.themes and maybe other things under /root
Status: CLOSED INSUFFICIENT_DATA
Product: Fedora
Classification: Fedora
Component: rhgb (Show other bugs)
2
i686 Linux
medium Severity medium
: ---
: ---
Assigned To: Ray Strode [halfline]
:
Depends On:
Blocks: 133471
  Show dependency treegraph
 
Reported: 2004-06-14 06:59 EDT by Russell Coker
Modified: 2008-08-02 19:40 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-10-25 16:04:35 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Russell Coker 2004-06-14 06:59:24 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (compatible; Konqueror/3.2; Linux) (KHTML, like Gecko)

Description of problem:
RHGB and other system processes should not use /root for their configuration files.  This is particularly important for graphical programs as changes for a root user X login should not affect the system boot process.

For good system management you want to track changes to all files that are used as part of the boot process to avoid unwelcome surprises when rebooting a server after a long period of uptime.  When system programs such as RHGB access configuration files under /root this may cause problems, with a potential result of making the system unbootable.

Here are URLs for a couple of threads of discussion referencing this:
http://www.redhat.com/archives/fedora-selinux-list/2004-June/msg00126.html
http://www.redhat.com/archives/fedora-selinux-list/2004-June/msg00155.html

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
Boot a SE Linux machine with RHGB and the "strict" policy and observe the AVC messages.

Additional info:
Comment 1 Daniel Veillard 2004-09-13 11:33:53 EDT
Hum, looking at it a bit, it's hard. This would require running rhgb
under a different account than root, and this is a significant change,

Daniel
Comment 2 Russell Coker 2004-09-13 11:45:20 EDT
I think that the best option is to modify the programs in question 
to determine a configuration directory by a method other than 
calling getpwuid(getuid()). 
 
One possibility is using $HOME which could trivially be set to 
another value.  Another possibility is to have an environment 
variable to specify the location ($GNOME_CONFIG maybe?), this could 
be useful for many things other than solving this problem. 
 
I agree that running rhgb as non-root is not the correct solution. 
Comment 3 Daniel Veillard 2004-09-13 11:56:04 EDT
it's not possible, the lookup is done in gtk libraries
it would require a specific extension to gtk+ . It does not
use $HOME , but getpwent() . 
Relying on a gtk+ enhancement is one way, I would first look
at running it as nobody instead, using setreuid() once X
has been started, this will be a pain because we will need to umount
the filesystem too, I'm not sure it will really work with gtk+ anyway.

Daniel
Comment 4 Daniel Veillard 2004-09-13 11:58:26 EDT
Seen your depend on bug, this is unlikely to get fixed on time for FC3
honnestly. Especially if there is a gtk+ change involved !

Daniel
Comment 5 Matthew Miller 2005-04-26 11:46:48 EDT
Fedora Core 2 is now maintained by the Fedora Legacy project for
security updates only. If this problem is a security issue, please
reopen and reassign to the Fedora Legacy product. If it is not a
security issue and hasn't been resolved in the current FC3 updates or
in the FC4 test release, reopen and change the version to match.
Comment 6 John Thacker 2006-10-25 16:04:35 EDT
Closed per above message and lack of response.  Note that FC2 is not even
supported by Fedora Legacy currently.

Note You need to log in before you can comment on or make changes to this bug.