Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
SELinux policy expects that udisksd location is one of following:
# semanage fcontext -l | grep udisksd
/lib/udisks2/udisksd regular file system_u:object_r:devicekit_disk_exec_t:s0
/usr/lib/udisks2/udisksd regular file system_u:object_r:devicekit_disk_exec_t:s0
#
but in reality udisksd is located:
# ls -l /usr/libexec/udisks2/udisksd
-rwxr-xr-x. 1 root root 430752 Nov 30 15:27 /usr/libexec/udisks2/udisksd
# matchpathcon /usr/libexec/udisks2/udisksd
/usr/libexec/udisks2/udisksd system_u:object_r:bin_t:s0
#
as a result the udisks2.service runs as unconfined_service_t.
Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-180.el7.noarch
selinux-policy-devel-3.13.1-180.el7.noarch
selinux-policy-doc-3.13.1-180.el7.noarch
selinux-policy-minimum-3.13.1-180.el7.noarch
selinux-policy-mls-3.13.1-180.el7.noarch
selinux-policy-sandbox-3.13.1-180.el7.noarch
selinux-policy-targeted-3.13.1-180.el7.noarch
udisks2-2.7.3-4.el7.x86_64
How reproducible:
* always
Steps to Reproduce:
# service udisks2 status
Redirecting to /bin/systemctl status udisks2.service
● udisks2.service - Disk Manager
Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Tue 2017-12-05 18:38:19 CET; 12min ago
Docs: man:udisks(8)
Process: 8885 ExecStart=/usr/libexec/udisks2/udisksd (code=exited, status=0/SUCCESS)
Main PID: 8885 (code=exited, status=0/SUCCESS)
Dec 05 18:38:15 pegas75.localdomain systemd[1]: Starting Disk Manager...
Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: udisks daemon version 2.7....
Dec 05 18:38:15 pegas75.localdomain systemd[1]: Started Disk Manager.
Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: Acquired the name org.free...
Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopping Disk Manager...
Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopped Disk Manager.
Hint: Some lines were ellipsized, use -l to show in full.
# service udisks2 start
Redirecting to /bin/systemctl start udisks2.service
# service udisks2 status
Redirecting to /bin/systemctl status udisks2.service
● udisks2.service - Disk Manager
Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2017-12-05 18:51:15 CET; 1s ago
Docs: man:udisks(8)
Main PID: 10235 (udisksd)
Tasks: 6
CGroup: /system.slice/udisks2.service
└─10235 /usr/libexec/udisks2/udisksd
Dec 05 18:51:15 pegas75.localdomain systemd[1]: Starting Disk Manager...
Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: udisks daemon version 2.7...
Dec 05 18:51:15 pegas75.localdomain systemd[1]: Started Disk Manager.
Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: Acquired the name org.fre...
Hint: Some lines were ellipsized, use -l to show in full.
# ps -efZ | grep udisk
system_u:system_r:unconfined_service_t:s0 root 10235 1 0 18:51 ? 00:00:00 /usr/libexec/udisks2/udisksd
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 10256 1289 0 18:51 pts/0 00:00:00 grep --color=auto udisk
#
Actual results:
/usr/libexec/udisks2/udisksd is labeled bin_t
Expected results:
/usr/libexec/udisks2/udisksd is labeled devicekit_disk_exec_t
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2018:3111
Description of problem: SELinux policy expects that udisksd location is one of following: # semanage fcontext -l | grep udisksd /lib/udisks2/udisksd regular file system_u:object_r:devicekit_disk_exec_t:s0 /usr/lib/udisks2/udisksd regular file system_u:object_r:devicekit_disk_exec_t:s0 # but in reality udisksd is located: # ls -l /usr/libexec/udisks2/udisksd -rwxr-xr-x. 1 root root 430752 Nov 30 15:27 /usr/libexec/udisks2/udisksd # matchpathcon /usr/libexec/udisks2/udisksd /usr/libexec/udisks2/udisksd system_u:object_r:bin_t:s0 # as a result the udisks2.service runs as unconfined_service_t. Version-Release number of selected component (if applicable): selinux-policy-3.13.1-180.el7.noarch selinux-policy-devel-3.13.1-180.el7.noarch selinux-policy-doc-3.13.1-180.el7.noarch selinux-policy-minimum-3.13.1-180.el7.noarch selinux-policy-mls-3.13.1-180.el7.noarch selinux-policy-sandbox-3.13.1-180.el7.noarch selinux-policy-targeted-3.13.1-180.el7.noarch udisks2-2.7.3-4.el7.x86_64 How reproducible: * always Steps to Reproduce: # service udisks2 status Redirecting to /bin/systemctl status udisks2.service ● udisks2.service - Disk Manager Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled) Active: inactive (dead) since Tue 2017-12-05 18:38:19 CET; 12min ago Docs: man:udisks(8) Process: 8885 ExecStart=/usr/libexec/udisks2/udisksd (code=exited, status=0/SUCCESS) Main PID: 8885 (code=exited, status=0/SUCCESS) Dec 05 18:38:15 pegas75.localdomain systemd[1]: Starting Disk Manager... Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: udisks daemon version 2.7.... Dec 05 18:38:15 pegas75.localdomain systemd[1]: Started Disk Manager. Dec 05 18:38:15 pegas75.localdomain udisksd[8885]: Acquired the name org.free... Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopping Disk Manager... Dec 05 18:38:19 pegas75.localdomain systemd[1]: Stopped Disk Manager. Hint: Some lines were ellipsized, use -l to show in full. # service udisks2 start Redirecting to /bin/systemctl start udisks2.service # service udisks2 status Redirecting to /bin/systemctl status udisks2.service ● udisks2.service - Disk Manager Loaded: loaded (/usr/lib/systemd/system/udisks2.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2017-12-05 18:51:15 CET; 1s ago Docs: man:udisks(8) Main PID: 10235 (udisksd) Tasks: 6 CGroup: /system.slice/udisks2.service └─10235 /usr/libexec/udisks2/udisksd Dec 05 18:51:15 pegas75.localdomain systemd[1]: Starting Disk Manager... Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: udisks daemon version 2.7... Dec 05 18:51:15 pegas75.localdomain systemd[1]: Started Disk Manager. Dec 05 18:51:15 pegas75.localdomain udisksd[10235]: Acquired the name org.fre... Hint: Some lines were ellipsized, use -l to show in full. # ps -efZ | grep udisk system_u:system_r:unconfined_service_t:s0 root 10235 1 0 18:51 ? 00:00:00 /usr/libexec/udisks2/udisksd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 10256 1289 0 18:51 pts/0 00:00:00 grep --color=auto udisk # Actual results: /usr/libexec/udisks2/udisksd is labeled bin_t Expected results: /usr/libexec/udisks2/udisksd is labeled devicekit_disk_exec_t