Bug 171612 - Incomplete policy definition for INNd (control* related programs to be exact).
Summary: Incomplete policy definition for INNd (control* related programs to be exact).
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted   
(Show other bugs)
Version: 4
Hardware: i386
OS: Linux
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2005-10-24 12:41 UTC by Pawel Sawicki
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-05-05 15:04:58 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

Description Pawel Sawicki 2005-10-24 12:41:07 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20050922 Fedora/1.0.7-1.1.fc4 Firefox/1.0.7

Description of problem:
After running the INNd with the SELinux protection (targeted policy) enforced I get errors in the audit log stating that numerous programs ("/usr/lib/news/bin/control/*" and "controlchan") do not have an access to "/var/spool/news/articles/control". Moreover "controlchan" itself can't access "/usr/lib/news/bin/control" directory.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Enforce SELinux protection (targeted policy).
2. Run INNd.
3. Check for "controlchan" to start... and fail. Same for eg. "ihave.pl".

Actual Results:  "controlchan" can't access binary files from within the "/usr/lib/news/bin/control" directory. Plus - programs from "/usr/lib/news/bin/control" directory (like "ihave.pl") can't access "/var/spool/news/articles/control".

Expected Results:  "controlchan" should have an access to the aforementioned files, since otherwise it cannot work correctly. Next - most (all?) programs from "/usr/lib/news/bin/control" directory should be allowed to "read" and "getattr" "news_spool_t".

Additional info:

Question - should we label all "/usr/lib/news/bin/control/*" with "innd_exec_t" (which will work out of the box) or maybe we could create smth like "innd_control_exec_t" & "news_spool_control_t" with finer control on what actually happens.

For the time being I've used the first approach and it worked. But...

Comment 1 Daniel Walsh 2005-11-30 20:56:33 UTC
Fixed in selinux-policy-targeted-1.27.1-2.14

Comment 3 Daniel Walsh 2006-05-05 15:04:58 UTC
Closing as these have been marked as modified, for a while.  Feel free to reopen
if not fixed

Note You need to log in before you can comment on or make changes to this bug.