Bug 1726166 - the lvmdbusd service runs as unconfined_service_t
Summary: the lvmdbusd service runs as unconfined_service_t
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: selinux-policy
Version: 8.1
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: 8.2
Assignee: Lukas Vrabec
QA Contact: Milos Malik
Jan Fiala
URL:
Whiteboard:
Depends On:
Blocks: 1726199 1755139
TreeView+ depends on / blocked
 
Reported: 2019-07-02 09:19 UTC by Milos Malik
Modified: 2021-08-30 13:06 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
.The `lvmdbusd` service is now confined by SELinux The `lvmdbusd` service provides a D-Bus API to the logical volume manager (LVM). Previously, the `lvmdbusd` daemon could not transition to the `lvm_t` context even though the SELinux policy for `lvm_t` was defined. As a consequence, the `lvmdbusd` daemon was executed in the `unconfined_service_t` domain and SELinux labeled `lvmdbusd` as unconfined. With this update, the `lvmdbusd` executable file has the `lvm_exec_t` context defined and `lvmdbusd` can now be used correctly with SELinux in enforcing mode.
Clone Of:
Environment:
Last Closed: 2020-04-28 16:40:35 UTC
Type: Bug
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-23793 0 None None None 2021-08-27 22:37:53 UTC
Red Hat Product Errata RHBA-2020:1773 0 None None None 2020-04-28 16:40:55 UTC

Description Milos Malik 2019-07-02 09:19:10 UTC
Description of problem:
 * the lvmdbusd service is shipped but it is not confined

Version-Release number of selected component (if applicable):
lvm2-2.03.05-1.el8.x86_64
lvm2-dbusd-2.03.05-1.el8.noarch
lvm2-libs-2.03.05-1.el8.x86_64
lvm2-lockd-2.03.05-1.el8.x86_64
selinux-policy-3.14.3-9.el8.noarch
selinux-policy-targeted-3.14.3-9.el8.noarch

How reproducible:
 * always

Steps to Reproduce:
# service lvm2-lvmdbusd status
Redirecting to /bin/systemctl status lvm2-lvmdbusd.service
● lvm2-lvmdbusd.service - LVM2 D-Bus service
   Loaded: loaded (/usr/lib/systemd/system/lvm2-lvmdbusd.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
     Docs: man:lvmdbusd(8)
# service lvm2-lvmdbusd start
Redirecting to /bin/systemctl start lvm2-lvmdbusd.service
# service lvm2-lvmdbusd status
Redirecting to /bin/systemctl status lvm2-lvmdbusd.service
● lvm2-lvmdbusd.service - LVM2 D-Bus service
   Loaded: loaded (/usr/lib/systemd/system/lvm2-lvmdbusd.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2019-07-02 05:14:54 EDT; 1s ago
     Docs: man:lvmdbusd(8)
 Main PID: 5379 (lvmdbusd)
    Tasks: 5 (limit: 11518)
   Memory: 13.4M
   CGroup: /system.slice/lvm2-lvmdbusd.service
           └─5379 /usr/libexec/platform-python /usr/sbin/lvmdbusd

Jul 02 05:14:54 ci-vm-10-0-136-62.hosted.upshift.rdu2.redhat.com systemd[1]: Starting LVM2 D-Bus service...
Jul 02 05:14:54 ci-vm-10-0-136-62.hosted.upshift.rdu2.redhat.com systemd[1]: Started LVM2 D-Bus service.
# ps -efZ | grep lvmdbusd
system_u:system_r:unconfined_service_t:s0 root 5379 1  1 05:14 ?       00:00:00 /usr/libexec/platform-python /usr/sbin/lvmdbusd
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 5400 4655  0 05:15 pts/0 00:00:00 grep --color=auto lvmdbusd
# ls -Z /usr/sbin/lvmdbusd
system_u:object_r:bin_t:s0 /usr/sbin/lvmdbusd
# 

Actual results:
 * the lvmdbusd service is not confined

Expected results:
 * the lvmdbusd service is confined

Comment 2 Nikola Knazekova 2019-08-07 14:25:05 UTC
PR for Fedora: https://github.com/fedora-selinux/selinux-policy/pull/271#

Added gen_context macro in lvm.fc to run lvmdbusd service as lvm_t.

Steps to Reproduce:
# service lvm2-lvmdbusd start
Redirecting to /bin/systemctl start lvm2-lvmdbusd.service
# service lvm2-lvmdbusd status
Redirecting to /bin/systemctl status lvm2-lvmdbusd.service
● lvm2-lvmdbusd.service - LVM2 D-Bus service
   Loaded: loaded (/usr/lib/systemd/system/lvm2-lvmdbusd.service; disabled; vendor preset: disabled)
   Active: active (running) since Wed 2019-08-07 10:59:22 CEST; 12s ago
     Docs: man:lvmdbusd(8)
 Main PID: 9587 (lvmdbusd)
    Tasks: 5 (limit: 4915)
   Memory: 13.9M
   CGroup: /system.slice/lvm2-lvmdbusd.service
           └─9587 /usr/bin/python3 /usr/sbin/lvmdbusd

Aug 07 10:59:22 localhost.localdomain systemd[1]: Starting LVM2 D-Bus service...
Aug 07 10:59:22 localhost.localdomain systemd[1]: Started LVM2 D-Bus service.
# ps -efZ | grep lvmdbusd
system_u:system_r:lvm_t:s0      root      9587     1  0 10:59 ?        00:00:00 /usr/bin/python3 /usr/sbin/lvmdbusd
# ls -Z /usr/sbin/lvmdbusd
system_u:object_r:lvm_exec_t:s0 /usr/sbin/lvmdbusd


Actual results:
 * the lvmdbusd service is confined

Comment 3 Lukas Vrabec 2019-08-08 11:36:33 UTC
commit 53ed93382217f9541bb9b125c93ff685046d91e1 (HEAD -> rawhide, origin/rawhide)
Author: Nikola Knazekova <nknazeko>
Date:   Wed Aug 7 13:34:47 2019 +0200

    Run lvmdbusd service as lvm_t
    
    Label binary /usr/sbin/lvmdbusd as lvm_exec_t to run lvmdbusd service as lvm_t.
    Lvmdbusd -  a service which provides a D-Bus API to the logical volume manager (LVM).

Fixed in Fedora Rawhide and Fedora 30.

Comment 16 errata-xmlrpc 2020-04-28 16:40:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1773


Note You need to log in before you can comment on or make changes to this bug.