RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1521063 - udisks2.service is not confined because the udisksd location has changed
Summary: udisks2.service is not confined because the udisksd location has changed
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.5
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-12-05 17:55 UTC by Milos Malik
Modified: 2018-10-30 10:01 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-10-30 10:01:27 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3111 0 None None None 2018-10-30 10:01:53 UTC

Description Milos Malik 2017-12-05 17:55:21 UTC 
Description of problem:

SELinux policy expects that udisksd location is one of following:

# semanage fcontext -l | grep udisksd
/lib/udisks2/udisksd                               regular file       system_u:object_r:devicekit_disk_exec_t:s0 
/usr/lib/udisks2/udisksd                           regular file       system_u:object_r:devicekit_disk_exec_t:s0 
#

but in reality udisksd is located:

# ls -l /usr/libexec/udisks2/udisksd
-rwxr-xr-x. 1 root root 430752 Nov 30 15:27 /usr/libexec/udisks2/udisksd
# matchpathcon /usr/libexec/udisks2/udisksd
/usr/libexec/udisks2/udisksd	system_u:object_r:bin_t:s0
# 

as a result the udisks2.service runs as unconfined_service_t.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-180.el7.noarch
selinux-policy-devel-3.13.1-180.el7.noarch
selinux-policy-doc-3.13.1-180.el7.noarch
selinux-policy-minimum-3.13.1-180.el7.noarch
selinux-policy-mls-3.13.1-180.el7.noarch
selinux-policy-sandbox-3.13.1-180.el7.noarch
selinux-policy-targeted-3.13.1-180.el7.noarch
udisks2-2.7.3-4.el7.x86_64

How reproducible:
* always

Steps to Reproduce:
# service udisks2 status
Redirecting to /bin/systemctl status udisks2.service
● udisks2.service - Disk Manager
   Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Tue 2017-12-05 18:38:19 CET; 12min ago
     Docs: man:udisks(8)
  Process: 8885 ExecStart=/usr/libexec/udisks2/udisksd (code=exited, status=0/SUCCESS)
 Main PID: 8885 (code=exited, status=0/SUCCESS)

Dec 05 18:38:15 pegas75.localdomain systemd[1]: Starting Disk Manager...
Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: udisks daemon version 2.7....
Dec 05 18:38:15 pegas75.localdomain systemd[1]: Started Disk Manager.
Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: Acquired the name org.free...
Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopping Disk Manager...
Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopped Disk Manager.
Hint: Some lines were ellipsized, use -l to show in full.
# service udisks2 start
Redirecting to /bin/systemctl start udisks2.service
# service udisks2 status
Redirecting to /bin/systemctl status udisks2.service
● udisks2.service - Disk Manager
   Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2017-12-05 18:51:15 CET; 1s ago
     Docs: man:udisks(8)
 Main PID: 10235 (udisksd)
    Tasks: 6
   CGroup: /system.slice/udisks2.service
           └─10235 /usr/libexec/udisks2/udisksd

Dec 05 18:51:15 pegas75.localdomain systemd[1]: Starting Disk Manager...
Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: udisks daemon version 2.7...
Dec 05 18:51:15 pegas75.localdomain systemd[1]: Started Disk Manager.
Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: Acquired the name org.fre...
Hint: Some lines were ellipsized, use -l to show in full.
# ps -efZ | grep udisk
system_u:system_r:unconfined_service_t:s0 root 10235 1  0 18:51 ?      00:00:00 /usr/libexec/udisks2/udisksd
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 10256 1289  0 18:51 pts/0 00:00:00 grep --color=auto udisk
# 

Actual results:
/usr/libexec/udisks2/udisksd is labeled bin_t

Expected results:
/usr/libexec/udisks2/udisksd is labeled devicekit_disk_exec_t
Comment 2 Milos Malik 2018-07-24 11:51:50 UTC 
Is the move to RHEL-7.7 intentional? What about RHEL-7.6?
Comment 6 errata-xmlrpc 2018-10-30 10:01:27 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111
Note You need to log in before you can comment on or make changes to this bug.