Bug 784619 - semanage is sending the wrong kind of audit events
Summary: semanage is sending the wrong kind of audit events
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: policycoreutils
Version: 5.8
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On: 784121
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-01-25 15:12 UTC by Milos Malik
Modified: 2019-01-30 08:40 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 784121
Environment:
Last Closed: 2013-12-09 14:24:03 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Milos Malik 2012-01-25 15:12:01 UTC
+++ This bug was initially created as a clone of Bug #784121 +++

Description of problem:
Semanage is sending the wrong kind of audit events. When a user is assigned a new role, an AUDIT_ROLE_ASSIGN event should be sent. When a user has a role removed, an AUDIT_ROLE_REMOVE event should be sent. When a user's process changes roles, like during login, its supposed to issue an AUDIT_USER_ROLE_CHANGE event.

Semanage is only sending AUDIT_USER_ROLE_CHANGE - which is the wrong kind of event.

# rpm -qa policycoreutils\*
policycoreutils-newrole-1.33.12-14.8.el5
policycoreutils-gui-1.33.12-14.8.el5
policycoreutils-1.33.12-14.8.el5

How reproducible:
Always

Steps to Reproduce:
1. semanage user --add -R staff_r test
2. ausearch -m ROLE_ASSIGN --start recent

Comment 1 RHEL Program Management 2012-06-12 01:24:01 UTC
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated in the
current release, Red Hat is unfortunately unable to address this
request at this time. Red Hat invites you to ask your support
representative to propose this request, if appropriate and relevant,
in the next release of Red Hat Enterprise Linux.

Comment 2 Miroslav Grepl 2013-03-19 15:17:16 UTC
Milos,
I would move it on RHEL6 until we get Fedora fix.

Comment 3 Milos Malik 2013-03-21 14:59:55 UTC
No problem.


Note You need to log in before you can comment on or make changes to this bug.