Bug 171612 - Incomplete policy definition for INNd (control* related programs to be exact).
Incomplete policy definition for INNd (control* related programs to be exact).
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
4
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-10-24 08:41 EDT by Pawel Sawicki
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-05-05 11:04:58 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Pawel Sawicki 2005-10-24 08:41:07 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20050922 Fedora/1.0.7-1.1.fc4 Firefox/1.0.7

Description of problem:
After running the INNd with the SELinux protection (targeted policy) enforced I get errors in the audit log stating that numerous programs ("/usr/lib/news/bin/control/*" and "controlchan") do not have an access to "/var/spool/news/articles/control". Moreover "controlchan" itself can't access "/usr/lib/news/bin/control" directory.

Version-Release number of selected component (if applicable):
inn-2.4.2-4

How reproducible:
Always

Steps to Reproduce:
1. Enforce SELinux protection (targeted policy).
2. Run INNd.
3. Check for "controlchan" to start... and fail. Same for eg. "ihave.pl".
  

Actual Results:  "controlchan" can't access binary files from within the "/usr/lib/news/bin/control" directory. Plus - programs from "/usr/lib/news/bin/control" directory (like "ihave.pl") can't access "/var/spool/news/articles/control".

Expected Results:  "controlchan" should have an access to the aforementioned files, since otherwise it cannot work correctly. Next - most (all?) programs from "/usr/lib/news/bin/control" directory should be allowed to "read" and "getattr" "news_spool_t".

Additional info:

Question - should we label all "/usr/lib/news/bin/control/*" with "innd_exec_t" (which will work out of the box) or maybe we could create smth like "innd_control_exec_t" & "news_spool_control_t" with finer control on what actually happens.

For the time being I've used the first approach and it worked. But...
Comment 1 Daniel Walsh 2005-11-30 15:56:33 EST
Fixed in selinux-policy-targeted-1.27.1-2.14
Comment 3 Daniel Walsh 2006-05-05 11:04:58 EDT
Closing as these have been marked as modified, for a while.  Feel free to reopen
if not fixed

Note You need to log in before you can comment on or make changes to this bug.