Hide Forgot
Description of problem: Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-145.el6.noarch selinux-policy-doc-3.7.19-145.el6.noarch selinux-policy-mls-3.7.19-145.el6.noarch selinux-policy-3.7.19-145.el6.noarch selinux-policy-minimum-3.7.19-145.el6.noarch openhpi-2.14.1-3.el6.x86_64 How reproducible: always Steps to Reproduce: # run_init service openhpid status Authenticating root. Password: openhpid is stopped # run_init service openhpid start Authenticating root. Password: Starting openhpid: [ OK ] # run_init service openhpid status Authenticating root. Password: openhpid (pid 13446) is running... # ps -efZ | grep initrc_t system_u:system_r:initrc_t:s0 root 13446 1 0 19:51 ? 00:00:00 /usr/sbin/openhpid -c /etc/openhpi/openhpi.conf unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 13463 12100 0 19:51 pts/1 00:00:00 grep initrc_t # Actual results: * openhpid runs as initrc_t Expected results: * openhpid runs in its own SELinux domain
The daemon is not confined by SELinux. Please help SELinux folks to create a suitable policy module. You know that we should minimize the number of programs running as initrc_t, don't you?
Created attachment 577059 [details] openhpi policy Just download the attachment and run $ semodule -i openhpid.pp $ restorecon -R -v /usr/sbin/openhpid /var/lib/openhp $ service openhpid restart and test it. Then run $ ausearch -m avc -ts recent
You will get type=AVC msg=audit(1334235373.417:1461): avc: denied { name_bind } for pid=30457 comm="openhpid" src=4743 scontext=unconfined_u:system_r:openhpid_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket at least.
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development. This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
This request was evaluated by Red Hat Product Management for inclusion in the current release of Red Hat Enterprise Linux. Because the affected component is not scheduled to be updated in the current release, Red Hat is unable to address this request at this time. Red Hat invites you to ask your support representative to propose this request, if appropriate, in the next release of Red Hat Enterprise Linux.
Miroslav, this policy is included in selinux rhel repo.
Policy is included in selinux-policy package for RHEL6.5