Bug 1521063 - udisks2.service is not confined because the udisksd location has changed
Summary: udisks2.service is not confined because the udisksd location has changed
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.5
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-12-05 17:55 UTC by Milos Malik
Modified: 2018-10-30 10:01 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 10:01:27 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3111 None None None 2018-10-30 10:01:53 UTC

Description Milos Malik 2017-12-05 17:55:21 UTC
Description of problem:

SELinux policy expects that udisksd location is one of following:

# semanage fcontext -l | grep udisksd
/lib/udisks2/udisksd                               regular file       system_u:object_r:devicekit_disk_exec_t:s0 
/usr/lib/udisks2/udisksd                           regular file       system_u:object_r:devicekit_disk_exec_t:s0 
#

but in reality udisksd is located:

# ls -l /usr/libexec/udisks2/udisksd
-rwxr-xr-x. 1 root root 430752 Nov 30 15:27 /usr/libexec/udisks2/udisksd
# matchpathcon /usr/libexec/udisks2/udisksd
/usr/libexec/udisks2/udisksd	system_u:object_r:bin_t:s0
# 

as a result the udisks2.service runs as unconfined_service_t.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-180.el7.noarch
selinux-policy-devel-3.13.1-180.el7.noarch
selinux-policy-doc-3.13.1-180.el7.noarch
selinux-policy-minimum-3.13.1-180.el7.noarch
selinux-policy-mls-3.13.1-180.el7.noarch
selinux-policy-sandbox-3.13.1-180.el7.noarch
selinux-policy-targeted-3.13.1-180.el7.noarch
udisks2-2.7.3-4.el7.x86_64

How reproducible:
* always

Steps to Reproduce:
# service udisks2 status
Redirecting to /bin/systemctl status udisks2.service
● udisks2.service - Disk Manager
   Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Tue 2017-12-05 18:38:19 CET; 12min ago
     Docs: man:udisks(8)
  Process: 8885 ExecStart=/usr/libexec/udisks2/udisksd (code=exited, status=0/SUCCESS)
 Main PID: 8885 (code=exited, status=0/SUCCESS)

Dec 05 18:38:15 pegas75.localdomain systemd[1]: Starting Disk Manager...
Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: udisks daemon version 2.7....
Dec 05 18:38:15 pegas75.localdomain systemd[1]: Started Disk Manager.
Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: Acquired the name org.free...
Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopping Disk Manager...
Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopped Disk Manager.
Hint: Some lines were ellipsized, use -l to show in full.
# service udisks2 start
Redirecting to /bin/systemctl start udisks2.service
# service udisks2 status
Redirecting to /bin/systemctl status udisks2.service
● udisks2.service - Disk Manager
   Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2017-12-05 18:51:15 CET; 1s ago
     Docs: man:udisks(8)
 Main PID: 10235 (udisksd)
    Tasks: 6
   CGroup: /system.slice/udisks2.service
           └─10235 /usr/libexec/udisks2/udisksd

Dec 05 18:51:15 pegas75.localdomain systemd[1]: Starting Disk Manager...
Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: udisks daemon version 2.7...
Dec 05 18:51:15 pegas75.localdomain systemd[1]: Started Disk Manager.
Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: Acquired the name org.fre...
Hint: Some lines were ellipsized, use -l to show in full.
# ps -efZ | grep udisk
system_u:system_r:unconfined_service_t:s0 root 10235 1  0 18:51 ?      00:00:00 /usr/libexec/udisks2/udisksd
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 10256 1289  0 18:51 pts/0 00:00:00 grep --color=auto udisk
# 

Actual results:
/usr/libexec/udisks2/udisksd is labeled bin_t

Expected results:
/usr/libexec/udisks2/udisksd is labeled devicekit_disk_exec_t

Comment 2 Milos Malik 2018-07-24 11:51:50 UTC
Is the move to RHEL-7.7 intentional? What about RHEL-7.6?

Comment 6 errata-xmlrpc 2018-10-30 10:01:27 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111


Note You need to log in before you can comment on or make changes to this bug.