Bug 810988 - abrt-watch-log is running as initrc_t
abrt-watch-log is running as initrc_t
Product: Fedora
Classification: Fedora
Component: abrt (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: abrt
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2012-04-09 15:46 EDT by Miroslav Grepl
Modified: 2012-08-10 01:49 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-08-10 01:49:16 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Miroslav Grepl 2012-04-09 15:46:11 EDT
Description of problem:

$ ps -eZ |grep initrc
system_u:system_r:initrc_t:s0     661 ?        00:00:00 abrt-watch-log

I created an initial policy an run ausearch+audit2allow

#============= abrt_watch_log_exec_t ==============
allow abrt_watch_log_exec_t abrt_dump_oops_exec_t:file { read execute open execute_no_trans };
allow abrt_watch_log_exec_t abrt_etc_t:file { read getattr open };
allow abrt_watch_log_exec_t locale_t:file { read getattr open };
allow abrt_watch_log_exec_t var_log_t:file { read open };

I see: abrt-watch-log

"This patch splits abrt-dump-oops into a generic log watcher tool,
abrt-watch-log, and oops finder, which retains the name

$ abrt-watch-log --help
Usage: abrt-watch-log [-vs] [-F STR]... FILE PROG [ARGS]

Watch log file FILE, run PROG when it grows or is replaced

    -v, --verbose               Be verbose
    -s                          Log to syslog
    -F STR                      Don't run PROG if STRs aren't found

So it means abrt-watch-log can run whatever? Do I understand correctly?
Comment 1 Daniel Walsh 2012-04-09 15:52:29 EDT
Why not run abrt_watch_log as logwatch_exec_t.
Comment 2 Miroslav Grepl 2012-04-10 03:26:01 EDT
It needs execute abrt_dump_oops_exec_t and I think it will end up as unconfined.
Comment 3 Jiri Moskovcak 2012-08-09 18:15:07 EDT
Does the policy already exist? Can we close this bug?
Comment 4 Miroslav Grepl 2012-08-10 01:49:16 EDT
Yes, we can close it.

system_u:system_r:abrt_watch_log_t:s0 674 ?    00:00:00 abrt-watch-log

Note You need to log in before you can comment on or make changes to this bug.