Hide Forgot
Description of problem: Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-145.el6.noarch selinux-policy-doc-3.7.19-145.el6.noarch selinux-policy-mls-3.7.19-145.el6.noarch selinux-policy-3.7.19-145.el6.noarch selinux-policy-minimum-3.7.19-145.el6.noarch rusers-server-0.17-61.el6.x86_64 How reproducible: always Steps to Reproduce: # service rusersd status rpc.rusersd is stopped # service rstatd status rpc.rstatd is stopped # run_init service rusersd start Authenticating root. Password: Starting rusers services: [ OK ] # run_init service rstatd start Authenticating root. Password: Starting rstat services: [ OK ] # service rusersd status rpc.rusersd (pid 14248) is running... # service rstatd status rpc.rstatd (pid 14266) is running... # ps -efZ | grep initrc_t system_u:system_r:initrc_t:s0 nobody 14248 1 0 20:42 ? 00:00:00 rpc.rusersd system_u:system_r:initrc_t:s0 root 14266 1 0 20:42 ? 00:00:00 rpc.rstatd unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 14292 12100 0 20:42 pts/1 00:00:00 grep initrc_t # Actual results: * both rpc.rstatd and rpc.rusersd run as initrc_t Expected results: * both rpc.rstatd and rpc.rusersd run in their own SELinux domain
The daemon is not confined by SELinux. Please help SELinux folks to create a suitable policy module. You know that we should minimize the number of programs running as initrc_t, don't you?
I tried to sum up some potential SELinux-related actions. However, re-assigning to selinux-policy, since I'm not able to write the rules myself. Hope the following helps; if any questions, just ask. rstatd: * daemonizes: fork + setsid * writes log messages to Syslog * reads /proc/stat * reads /proc/net/dev * reads /proc/diskstats * reads /proc/uptime * reads /proc/loadavg * registers rpcbind services (udp socket): 100001 3 udp rstatd 100001 2 udp rstatd 100001 1 udp rstatd rusersd: * daemonizes: fork + setsid * writes log messages to Syslog * getutent() * stat(/dev/ttyX) * registers rpcbind services (udp socket): 100002 3 udp rusersd 100002 2 udp rusersd
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development. This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
*** This bug has been marked as a duplicate of bug 851128 ***