Bug 220907
| Summary: | LSPP: Cron does not run as root user | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Camilo Y. Campo <camilo> | ||||
| Component: | crontabs | Assignee: | Marcela Mašláňová <mmaslano> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Brock Organ <borgan> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 5.0 | CC: | dwalsh, iboverma, james.antill, jplans, klaus, krisw, linda.knippers, sglass, sgrubb, toml | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | 5.0.0 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2007-01-23 20:56:03 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Camilo Y. Campo
2006-12-28 18:31:17 UTC
More informations, using root, no logs are generated, just cron logging on /var/log/cron : -- Dec 28 22:30:32 zaphod crontab[2509]: (root) REPLACE (root) Dec 28 22:30:35 zaphod crontab[2510]: (root) LIST (root) Dec 28 22:31:02 zaphod crond[1344]: (root) Unauthorized SELinux context (cron/root) -- When using a non-root user, everything seems to work as expected. -- Audit log when cron is working properly (not as root user) In this file I put the audit log when crons is working properly(as ealuser): -bash-3.1$ id uid=500(ealuser) gid=500(ealuser) groups=10(wheel),500(ealuser) context=staff_u:staff_r:staff_t:SystemLow-SystemHigh -bash-3.1$ cat ct MLS_LEVEL=SystemHigh * * * * * id -Z > /tmp/crontest -bash-3.1$ crontab ct -bash-3.1$ crontab -l MLS_LEVEL=SystemHigh * * * * * id -Z > /tmp/crontest /var/log/cron: Dec 28 22:41:25 zaphod crontab[2541]: (ealuser) REPLACE (ealuser) Dec 28 22:41:29 zaphod crontab[2542]: (ealuser) LIST (ealuser) Dec 28 22:42:01 zaphod crond[2553]: (ealuser) CMD (id -Z > /tmp/crontest) -- Created attachment 144532 [details]
Logs when cron is working as non-root.
Fixed in vixie-cron-4.1-66.1.el5 Available on http://people.redhat.com/dwalsh/SELinux/RHEL5 The new vixie is still not working properly: [root@zaphod /]# rpm -qa | grep vixie vixie-cron-4.1-66.1.el5 cron log: Jan 2 10:31:43 zaphod crontab[5373]: (root) REPLACE (root) Jan 2 10:32:01 zaphod crond[5277]: (root) RELOAD (cron/root) Jan 2 10:32:01 zaphod crond[5277]: (root) No SELinux security context (cron/root) This works for me. With the latest policy selinux-policy-2.4.6-22. With vixie-cron-4.1-66.1.el5 I do not use polyinstatiation on root logins. I login as root on the machine. # newrole -r sysadm_r # mkdir /tmp/SystemHigh # chcon -l SystemHigh /tmp/SystemHigh # crontab -e MLS_LEVEL=SystemHigh 0-59 * * * * id -Z > /tmp/SystemHigh/crontest And it works fine. New policy is necessary to chon -l. Now if I log in as a normal user with polyinstatiation. And do the exact same thing, it will not work because when cron runs it will use the default /tmp and there will not be a SystemHigh directory. You should be getting email on this as root. Agree, works for me. The newer vixie-cron along with the updated selinux-policy will be available in Snapshot 6 . . . I suspect that the new selinux-policy is needed along with the vixie-cron for this to work. Agree too. the problem was when I created the directory as root (staff user + /bin/su -) and the context was root root staff_u:object_r:sysadm_tmp_t:SystemHigh and not root root root:object_r:sysadm_tmp_t:SystemHigh. Thanks. selinux-policy-2.4.6-24.el5 and vixie-cron-4.1-66.1.el5 are included in 20070111.1 and 20070112.3. |