Bug 801015 - matahari-qmf-rpcd runs as initrc_t
Summary: matahari-qmf-rpcd runs as initrc_t
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.2
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks: 832330
TreeView+ depends on / blocked
 
Reported: 2012-03-07 14:29 UTC by Milos Malik
Modified: 2013-06-06 13:28 UTC (History)
1 user (show)

Fixed In Version: selinux-policy-3.7.19-142.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-06-20 12:31:54 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0780 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2012-06-19 20:34:59 UTC

Description Milos Malik 2012-03-07 14:29:39 UTC
Description of problem:


Version-Release number of selected component (if applicable):
selinux-policy-mls-3.7.19-138.el6.noarch
selinux-policy-3.7.19-138.el6.noarch
selinux-policy-doc-3.7.19-138.el6.noarch
selinux-policy-minimum-3.7.19-138.el6.noarch
selinux-policy-targeted-3.7.19-138.el6.noarch

How reproducible:
always

Steps to Reproduce:
# service matahari-rpc restart
Stopping the matahari-rpc daemon:                          [  OK  ]
Starting the matahari-rpc daemon:                          [  OK  ]
# ps -efZ | grep initrc
unconfined_u:system_r:initrc_t:s0 root    1972     1  0 15:26 ?        00:00:00 matahari-qmf-rpcd --broker 127.0.0.1 --reconnect=yes --daemon
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 1976 1826  0 15:26 pts/0 00:00:00 grep initrc
# 
  
Actual results:
* matahari-qmf-rpcd run as initrc_t

Expected results:
* matahari-qmf-rpcd runs in its own SELinux domain

Comment 2 Milos Malik 2012-03-07 15:31:39 UTC
Please fix also following matahari* AVCs:
----
time->Wed Mar  7 16:25:07 2012
type=SYSCALL msg=audit(1331133907.378:185): arch=40000003 syscall=156 success=yes exit=0 a0=2439 a1=0 a2=bf8982c8 a3=b78b47a0 items=0 ppid=1 pid=9273 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="matahari-qmf-ho" exe="/usr/sbin/matahari-qmf-hostd" subj=unconfined_u:system_r:matahari_hostd_t:s0 key=(null)
type=AVC msg=audit(1331133907.378:185): avc:  denied  { setsched } for  pid=9273 comm="matahari-qmf-ho" scontext=unconfined_u:system_r:matahari_hostd_t:s0 tcontext=unconfined_u:system_r:matahari_hostd_t:s0 tclass=process
type=AVC msg=audit(1331133907.378:185): avc:  denied  { sys_nice } for  pid=9273 comm="matahari-qmf-ho" capability=23  scontext=unconfined_u:system_r:matahari_hostd_t:s0 tcontext=unconfined_u:system_r:matahari_hostd_t:s0 tclass=capability
----
time->Wed Mar  7 16:25:17 2012
type=SYSCALL msg=audit(1331133917.891:186): arch=40000003 syscall=156 success=yes exit=0 a0=24da a1=0 a2=bfda4638 a3=b77577a0 items=0 ppid=1 pid=9434 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="matahari-qmf-ne" exe="/usr/sbin/matahari-qmf-networkd" subj=unconfined_u:system_r:matahari_netd_t:s0 key=(null)
type=AVC msg=audit(1331133917.891:186): avc:  denied  { setsched } for  pid=9434 comm="matahari-qmf-ne" scontext=unconfined_u:system_r:matahari_netd_t:s0 tcontext=unconfined_u:system_r:matahari_netd_t:s0 tclass=process
type=AVC msg=audit(1331133917.891:186): avc:  denied  { sys_nice } for  pid=9434 comm="matahari-qmf-ne" capability=23  scontext=unconfined_u:system_r:matahari_netd_t:s0 tcontext=unconfined_u:system_r:matahari_netd_t:s0 tclass=capability
----
time->Wed Mar  7 16:25:36 2012
type=SYSCALL msg=audit(1331133936.120:190): arch=40000003 syscall=156 success=yes exit=0 a0=2616 a1=0 a2=bf97bd28 a3=b78157a0 items=0 ppid=1 pid=9750 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="matahari-qmf-se" exe="/usr/sbin/matahari-qmf-serviced" subj=unconfined_u:system_r:matahari_serviced_t:s0 key=(null)
type=AVC msg=audit(1331133936.120:190): avc:  denied  { setsched } for  pid=9750 comm="matahari-qmf-se" scontext=unconfined_u:system_r:matahari_serviced_t:s0 tcontext=unconfined_u:system_r:matahari_serviced_t:s0 tclass=process
type=AVC msg=audit(1331133936.120:190): avc:  denied  { sys_nice } for  pid=9750 comm="matahari-qmf-se" capability=23  scontext=unconfined_u:system_r:matahari_serviced_t:s0 tcontext=unconfined_u:system_r:matahari_serviced_t:s0 tclass=capability
----
time->Wed Mar  7 16:25:45 2012
type=SYSCALL msg=audit(1331133945.752:191): arch=40000003 syscall=156 success=no exit=-13 a0=26a9 a1=0 a2=bfa367b8 a3=b77399d0 items=0 ppid=1 pid=9897 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="matahari-qmf-sy" exe="/usr/sbin/matahari-qmf-sysconfigd" subj=unconfined_u:system_r:matahari_sysconfigd_t:s0 key=(null)
type=AVC msg=audit(1331133945.752:191): avc:  denied  { setsched } for  pid=9897 comm="matahari-qmf-sy" scontext=unconfined_u:system_r:matahari_sysconfigd_t:s0 tcontext=unconfined_u:system_r:matahari_sysconfigd_t:s0 tclass=process
type=AVC msg=audit(1331133945.752:191): avc:  denied  { sys_nice } for  pid=9897 comm="matahari-qmf-sy" capability=23  scontext=unconfined_u:system_r:matahari_sysconfigd_t:s0 tcontext=unconfined_u:system_r:matahari_sysconfigd_t:s0 tclass=capability
----

Comment 3 Miroslav Grepl 2012-03-14 17:59:09 UTC
Added to selinux-policy-3.7.19-141.el6

Milos could you test it with this policy

Comment 8 Miroslav Grepl 2012-03-20 19:38:54 UTC
Fixed in selinux-policy-3.7.19-142.el6

Comment 11 errata-xmlrpc 2012-06-20 12:31:54 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0780.html


Note You need to log in before you can comment on or make changes to this bug.