Bug 722429

Created attachment 513354 [details]
script

Hello Tomas,

the context seems right to me. We do not transition services started via rgmanager into any other context. Rgmanager's context here is close to uconfined_t (i.e. can do almost anything).

It is this way because the clustered service configuration usually differs significantly to the one on single node. As this is very customer-dependent we do not define any restriction in this regard.

To achieve your goal, you'd have to create your own policy with the transition defined (rgmanager_t -> syslogd_t) or use runcon.

If you are interested in policy building and mass-transitions, I'd suggest looking at http://nstraz.wordpress.com/tag/qarsh/ where the selinux policy is built as part of the package and it uses all available interfaces for transition.

For your case this would mean including something like:
logging_domtrans_syslog(rgmanager_t)
in your own policy.
See the interface definition in /usr/share/selinux/devel/include/system/logging.if

If you would like to report any AVC denials, please include selinux-policy package version and the actual denial (ausearch -m AVC).

Hope this helps.

I have to correct myself a bit here.

rgmanager_t does indeed couple of transitions automatically.

rough list:
$ sesearch --type -s rgmanager_t  | grep exec_t
   type_transition rgmanager_t abrt_helper_exec_t : process abrt_helper_t; 
   type_transition rgmanager_t ping_exec_t : process ping_t; 
   type_transition rgmanager_t netutils_exec_t : process netutils_t; 
   type_transition rgmanager_t httpd_exec_t : process httpd_t; 
   type_transition rgmanager_t ifconfig_exec_t : process ifconfig_t; 
   type_transition rgmanager_t nfsd_exec_t : process nfsd_t; 
   type_transition rgmanager_t samba_initrc_exec_t : process initrc_t; 
   type_transition rgmanager_t postgresql_exec_t : process postgresql_t; 
   type_transition rgmanager_t rpcd_exec_t : process rpcd_t; 
   type_transition rgmanager_t sepgsql_db_t : db_procedure sepgsql_proc_exec_t; 
   type_transition rgmanager_t rpcd_initrc_exec_t : process initrc_t; 
   type_transition rgmanager_t mount_exec_t : process mount_t; 
   type_transition rgmanager_t fsadm_exec_t : process fsadm_t; 
   type_transition rgmanager_t fusermount_exec_t : process mount_t; 
   type_transition rgmanager_t slapd_exec_t : process slapd_t; 
   type_transition rgmanager_t xm_exec_t : process xm_t; 
   type_transition rgmanager_t slapd_initrc_exec_t : process initrc_t; 
   type_transition rgmanager_t sepgsql_schema_t : db_procedure sepgsql_proc_exec_t; 
   type_transition rgmanager_t unpriv_sepgsql_schema_t : db_procedure sepgsql_proc_exec_t; 
   type_transition rgmanager_t smbd_exec_t : process smbd_t; 
   type_transition rgmanager_t mysqld_safe_exec_t : process mysqld_safe_t; 
   type_transition rgmanager_t user_sepgsql_schema_t : db_procedure sepgsql_proc_exec_t; 
   type_transition rgmanager_t nmbd_exec_t : process nmbd_t; 
   type_transition rgmanager_t nfsd_initrc_exec_t : process initrc_t; 
   type_transition rgmanager_t lvm_exec_t : process lvm_t; 


So in some cases it is restricted (samba, httpd, mysqld,...) and rgmanager_t remains there if no transition is specified (and the service is very little restricted).

We might possibly add transtition for some others (or initrc_exec_t in general), but I'll let our selinux folks comment on that. 

As this is not a cluster bug rather than selinux-policy one I'll reassign this as well.

That seems reasonable to execute them in initrc_t.

Fixed in selinux-policy-3.7.19-104.el6

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1511.html