Bug 1287739 - lvmlockd runs as unconfined_service_t
Summary: lvmlockd runs as unconfined_service_t
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 24
Hardware: All
OS: Linux
high
medium
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 1278028
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-12-02 15:02 UTC by Lukas Vrabec
Modified: 2016-03-23 16:56 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-3.13.1-162.fc24 selinux-policy-3.13.1-179.fc24
Doc Type: Bug Fix
Doc Text:
Clone Of: 1278028
Environment:
Last Closed: 2016-03-23 16:56:38 UTC
Type: Bug


Attachments (Terms of Use)

Description Lukas Vrabec 2015-12-02 15:02:52 UTC
+++ This bug was initially created as a clone of Bug #1278028 +++

Description of problem:
 * it should most likely run in the same domain as other LVM daemons

Version-Release number of selected component (if applicable):
lvm2-2.02.130-5.el7.x86_64
lvm2-cluster-2.02.130-5.el7.x86_64
lvm2-libs-2.02.130-5.el7.x86_64
lvm2-lockd-2.02.130-5.el7.x86_64
lvm2-python-libs-2.02.130-5.el7.x86_64
lvm2-sysvinit-2.02.130-5.el7.x86_64
selinux-policy-3.13.1-60.el7.noarch
selinux-policy-devel-3.13.1-60.el7.noarch
selinux-policy-doc-3.13.1-60.el7.noarch
selinux-policy-minimum-3.13.1-60.el7.noarch
selinux-policy-mls-3.13.1-60.el7.noarch
selinux-policy-sandbox-3.13.1-60.el7.noarch
selinux-policy-targeted-3.13.1-60.el7.noarch

How reproducible:
always

Steps to Reproduce:
1. get a RHEL-7.2 machine with active targeted policy
2. install the lvm2-lockd package
3. service lvm2-lvmlockd start
4. check the context of lvmlockd process

Actual results:
system_u:system_r:unconfined_service_t:s0 root 4824 1  0 16:11 ?       00:00:00 /usr/sbin/lvmlockd -f

Expected results:
system_u:system_r:lvm_t:s0 root 4824 1  0 16:11 ?       00:00:00 /usr/sbin/lvmlockd -f

Additional info:
# matchpathcon `which lvmlockd`
/usr/sbin/lvmlockd	system_u:object_r:bin_t:s0
#

Comment 1 Lukas Vrabec 2015-12-03 12:07:01 UTC
commit bc09818bb7b2203edcd0ce9f0bd3f10b79159dc5
Author: Lukas Vrabec <lvrabec@redhat.com>
Date:   Thu Dec 3 12:39:18 2015 +0100

    Label /usr/sbin/lvmlockd binary file as lvm_exec_t. BZ(1287739)

Comment 2 Jan Kurik 2016-02-24 15:48:08 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 24 development cycle.
Changing version to '24'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora24#Rawhide_Rebase

Comment 3 Fedora Update System 2016-03-11 09:56:18 UTC
selinux-policy-3.13.1-178.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-1350c96015

Comment 4 Fedora Update System 2016-03-11 19:25:58 UTC
selinux-policy-3.13.1-178.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-1350c96015

Comment 5 Fedora Update System 2016-03-16 13:42:21 UTC
selinux-policy-3.13.1-179.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-8f142bb969

Comment 6 Fedora Update System 2016-03-18 14:58:50 UTC
selinux-policy-3.13.1-179.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-8f142bb969

Comment 7 Fedora Update System 2016-03-23 16:54:54 UTC
selinux-policy-3.13.1-179.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.