Hide Forgot
Description of problem: Services started with rgmanager are running in the wrong context. At least when run through custom scripts. Version-Release number of selected component (if applicable): resource-agents-3.0.12-22.el6.x86_64 rgmanager-3.0.12-11.el6.x86_64 How reproducible: Put a script in /usr/local/bin/rsyslog-restart.sh (attached). Stop and start the service. Actual results: # ps -efZ |grep rsysl system_u:system_r:rgmanager_t:s0 root 17856 1 0 10:28 ? 00:00:00 /sbin/rsyslogd -c 4 Expected results: unconfined_u:system_r:syslogd_t:s0 root 21498 1 0 10:15 ? 00:00:01 /sbin/rsyslogd -c 4 Additional info: This causes all sorts of problems, for one postfix is not able to log through the /dev/log socket.
Created attachment 513354 [details] script
Hello Tomas, the context seems right to me. We do not transition services started via rgmanager into any other context. Rgmanager's context here is close to uconfined_t (i.e. can do almost anything). It is this way because the clustered service configuration usually differs significantly to the one on single node. As this is very customer-dependent we do not define any restriction in this regard. To achieve your goal, you'd have to create your own policy with the transition defined (rgmanager_t -> syslogd_t) or use runcon. If you are interested in policy building and mass-transitions, I'd suggest looking at http://nstraz.wordpress.com/tag/qarsh/ where the selinux policy is built as part of the package and it uses all available interfaces for transition. For your case this would mean including something like: logging_domtrans_syslog(rgmanager_t) in your own policy. See the interface definition in /usr/share/selinux/devel/include/system/logging.if If you would like to report any AVC denials, please include selinux-policy package version and the actual denial (ausearch -m AVC). Hope this helps.
I have to correct myself a bit here. rgmanager_t does indeed couple of transitions automatically. rough list: $ sesearch --type -s rgmanager_t | grep exec_t type_transition rgmanager_t abrt_helper_exec_t : process abrt_helper_t; type_transition rgmanager_t ping_exec_t : process ping_t; type_transition rgmanager_t netutils_exec_t : process netutils_t; type_transition rgmanager_t httpd_exec_t : process httpd_t; type_transition rgmanager_t ifconfig_exec_t : process ifconfig_t; type_transition rgmanager_t nfsd_exec_t : process nfsd_t; type_transition rgmanager_t samba_initrc_exec_t : process initrc_t; type_transition rgmanager_t postgresql_exec_t : process postgresql_t; type_transition rgmanager_t rpcd_exec_t : process rpcd_t; type_transition rgmanager_t sepgsql_db_t : db_procedure sepgsql_proc_exec_t; type_transition rgmanager_t rpcd_initrc_exec_t : process initrc_t; type_transition rgmanager_t mount_exec_t : process mount_t; type_transition rgmanager_t fsadm_exec_t : process fsadm_t; type_transition rgmanager_t fusermount_exec_t : process mount_t; type_transition rgmanager_t slapd_exec_t : process slapd_t; type_transition rgmanager_t xm_exec_t : process xm_t; type_transition rgmanager_t slapd_initrc_exec_t : process initrc_t; type_transition rgmanager_t sepgsql_schema_t : db_procedure sepgsql_proc_exec_t; type_transition rgmanager_t unpriv_sepgsql_schema_t : db_procedure sepgsql_proc_exec_t; type_transition rgmanager_t smbd_exec_t : process smbd_t; type_transition rgmanager_t mysqld_safe_exec_t : process mysqld_safe_t; type_transition rgmanager_t user_sepgsql_schema_t : db_procedure sepgsql_proc_exec_t; type_transition rgmanager_t nmbd_exec_t : process nmbd_t; type_transition rgmanager_t nfsd_initrc_exec_t : process initrc_t; type_transition rgmanager_t lvm_exec_t : process lvm_t; So in some cases it is restricted (samba, httpd, mysqld,...) and rgmanager_t remains there if no transition is specified (and the service is very little restricted). We might possibly add transtition for some others (or initrc_exec_t in general), but I'll let our selinux folks comment on that. As this is not a cluster bug rather than selinux-policy one I'll reassign this as well.
That seems reasonable to execute them in initrc_t.
Fixed in selinux-policy-3.7.19-104.el6
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1511.html