Bug 1303644 - setrlimit is allowed for all domains
setrlimit is allowed for all domains
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.2
All Linux
high Severity high
: rc
: ---
Assigned To: Lukas Vrabec
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-01 09:53 EST by Milos Malik
Modified: 2016-11-03 22:41 EDT (History)
6 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-75.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-03 22:41:29 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Milos Malik 2016-02-01 09:53:08 EST
Description of problem:
 * there are 2 booleans which allow setrlimit operation (httpd_setrlimit and zarafa_setrlimit) but the base.pp contains an allow rule which allows all domains to do setrlimit

Version-Release number of selected component (if applicable):
selinux-policy-devel-3.13.1-60.el7.noarch
selinux-policy-minimum-3.13.1-60.el7.noarch
selinux-policy-mls-3.13.1-60.el7.noarch
selinux-policy-sandbox-3.13.1-60.el7.noarch
selinux-policy-targeted-3.13.1-60.el7.noarch
selinux-policy-3.13.1-60.el7.noarch
selinux-policy-doc-3.13.1-60.el7.noarch

How reproducible:
always

Steps to Reproduce:
# find /etc/selinux/targeted/ -name base.pp
/etc/selinux/targeted/modules/active/base.pp
# cp `find /etc/selinux/targeted/ -name base.pp` .
# mv base.pp base.pp.bz2
# bzip2 -d base.pp.bz2 
# sedismod base.pp 
Reading policy...
libsepol.policydb_index_others: security:  5 users, 6 roles, 1323 types, 25 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security:  83 classes, 0 rules, 0 cond rules
libsepol.policydb_index_others: security:  5 users, 6 roles, 1323 types, 25 bools
libsepol.policydb_index_others: security: 1 sens, 1024 cats
libsepol.policydb_index_others: security:  83 classes, 0 rules, 0 cond rules
Binary base policy file loaded.

Select a command:
1)  display unconditional AVTAB
2)  display conditional AVTAB
3)  display users
4)  display bools
5)  display roles
6)  display types, attributes, and aliases
7)  display role transitions
8)  display role allows
9)  Display policycon
0)  Display initial SIDs
a)  Display avrule requirements
b)  Display avrule declarations
c)  Display policy capabilities
l)  Link in a module
u)  Display the unknown handling setting
F)  Display filename_trans rules
f)  set output file
m)  display menu
q)  quit

Command ('m' for menu):  f

Filename for output (<CR> for screen output): output.txt

Output to file: output.txt

Command ('m' for menu):  1

Command ('m' for menu):  q
# grep "allow domain.*setrlimit" output.txt 
  allow domain self : process { fork sigchld sigkill sigstop signull signal getsched getsession getcap getattr setrlimit };
#

Expected results:
 * either both booleans are redundant or the above-mentioned rule should not contain the setrlimit permission

Additional info:
 * more than 700 domains is allowed to do setrlimit

# sesearch -c process -p setrlimit -A -C | grep -v '\[' | wc -l
798
#
Comment 7 errata-xmlrpc 2016-11-03 22:41:29 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2283.html

Note You need to log in before you can comment on or make changes to this bug.