From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.10) Gecko/20050810 Red Hat/1.7.10-0.90.1.legacy

Description of problem:
The default SELinux policy for FC4 (updated via yum) doesn't allow rexec access.  After enabling rexec in /etc/xinetd.d and opening up port 512/tcp in iptables, rexec access to the system still fails because of a broken or missing SELinux policy for /usr/sbin/in.rexecd.  By default, in.rexecd is assigned the context system_u:object_r:inetd_child_exec_t, which doesn't allow the process to do a whole lot.  Setting this to system_u:object_r:rshd_exec_t, which is the context for in.rshd, makes rexec access work.

Version-Release number of selected component (if applicable):
selinux-policy-targeted-1.27.1-2.3

How reproducible:
Always

Steps to Reproduce:
1. yum install rsh-server; chkconfig rexec enable
2. Add entries for TCP port 512 to /etc/sysconfig/iptables and /etc/sysconfig/system-config-securitylevel, then "service iptables restart".
3. Try "rexec -a rhost '/usr/X11R6/bin/xterm -display myhost:0'", where rhost is the FC4 system on which you enabled rexec access.
  

Actual Results:  The rexec client reports:

rhost: No such file or directory
rexec: Error in rexec system call,
rexec: (The following system error may itself be in error)
rexec: Illegal seek

The /var/log/messages file on rhost reports:

Oct 12 14:20:55 rhost in.rexecd[5411]: connect from myhost
Oct 12 14:20:55 rhost rexec(pam_unix)[5411]: authentication failure; logname= uid=0 euid=0 tty=rexec ruser= rhost=  user=grdetil
Oct 12 14:20:58 rhost in.rexecd[5411]: PAM audit_open() failed: Permission denied
Oct 12 14:20:58 rhost in.rexecd[5411]: PAM audit_open() failed: Permission denied

Expected Results:  Client should open xterm window with shell running on rhost.  rhost should log:

Oct 12 15:40:32 rhost in.rexecd[6219]: connect from myhost
Oct 12 15:40:32 rhost rexec(pam_unix)[6219]: session opened for user grdetil by (uid=0)
Oct 12 15:40:32 rhost rexec(pam_unix)[6219]: session closed for user grdetil
Oct 12 15:40:32 rhost in.rexecd[6219]: login from myhost as grdetil

Additional info:

A quick but temporary fix is:

chcon system_u:object_r:rshd_exec_t /usr/sbin/in.rexecd

I say temporary because I realize that the next run of fixfiles, setfiles, restorecon, or whatever is likely to reset in.rexecd back to system_u:object_r:inetd_child_exec_t.  If it makes sense to have rexecd run under rshd's policy, then in.rexecd should probably be added to /etc/selinux/targeted/src/policy/file_contexts/program/rshd.fc (and ulimately make its way into /etc/selinux/targeted/contexts/files/file_contexts) to make the change permanent.  If rexecd ought to have its own independent policy, then these should be defined appropriately in /etc/selinux/targeted/src/policy/file_contexts/program/ and /etc/selinux/targeted/src/policy/domains/program/ in the next policy update.