Bug 810988 - abrt-watch-log is running as initrc_t
Summary: abrt-watch-log is running as initrc_t
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: abrt
Version: 17
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: abrt
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-04-09 19:46 UTC by Miroslav Grepl
Modified: 2012-08-10 05:49 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-08-10 05:49:16 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Miroslav Grepl 2012-04-09 19:46:11 UTC
Description of problem:

$ ps -eZ |grep initrc
system_u:system_r:initrc_t:s0     661 ?        00:00:00 abrt-watch-log


I created an initial policy an run ausearch+audit2allow

#============= abrt_watch_log_exec_t ==============
allow abrt_watch_log_exec_t abrt_dump_oops_exec_t:file { read execute open execute_no_trans };
allow abrt_watch_log_exec_t abrt_etc_t:file { read getattr open };
allow abrt_watch_log_exec_t locale_t:file { read getattr open };
allow abrt_watch_log_exec_t var_log_t:file { read open };


I see: abrt-watch-log

"This patch splits abrt-dump-oops into a generic log watcher tool,
abrt-watch-log, and oops finder, which retains the name
abrt-dump-oops"

$ abrt-watch-log --help
Usage: abrt-watch-log [-vs] [-F STR]... FILE PROG [ARGS]

Watch log file FILE, run PROG when it grows or is replaced

    -v, --verbose               Be verbose
    -s                          Log to syslog
    -F STR                      Don't run PROG if STRs aren't found


So it means abrt-watch-log can run whatever? Do I understand correctly?

Comment 1 Daniel Walsh 2012-04-09 19:52:29 UTC
Why not run abrt_watch_log as logwatch_exec_t.

Comment 2 Miroslav Grepl 2012-04-10 07:26:01 UTC
It needs execute abrt_dump_oops_exec_t and I think it will end up as unconfined.

Comment 3 Jiri Moskovcak 2012-08-09 22:15:07 UTC
Does the policy already exist? Can we close this bug?

Comment 4 Miroslav Grepl 2012-08-10 05:49:16 UTC
Yes, we can close it.

system_u:system_r:abrt_watch_log_t:s0 674 ?    00:00:00 abrt-watch-log


Note You need to log in before you can comment on or make changes to this bug.