Bug 848804 - tgtd runs as initrc_t
Summary: tgtd runs as initrc_t
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: selinux-policy
Version: 5.9
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks: 848708
TreeView+ depends on / blocked
 
Reported: 2012-08-16 12:49 UTC by Milos Malik
Modified: 2012-09-22 07:53 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-08-20 08:40:12 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Milos Malik 2012-08-16 12:49:22 UTC 
Description of problem:


Version-Release number of selected component (if applicable):
selinux-policy-minimum-2.4.6-331.el5
selinux-policy-devel-2.4.6-331.el5
selinux-policy-targeted-2.4.6-331.el5
selinux-policy-2.4.6-331.el5
selinux-policy-strict-2.4.6-331.el5
selinux-policy-mls-2.4.6-331.el5
scsi-target-utils-1.0.14-2.el5

How reproducible:
always

Steps to Reproduce:
# run_init service tgtd status
Authenticating root.
Password: 
tgtd is stopped
# run_init service tgtd start
Authenticating root.
Password: 
Starting SCSI target daemon: Starting target framework daemon

# ps -efZ | grep tgtd
user_u:system_r:initrc_t        root     23211     1  0 14:48 ?        00:00:00 tgtd
user_u:system_r:initrc_t        root     23212 23211  0 14:48 ?        00:00:00 tgtd
root:system_r:unconfined_t:SystemLow-SystemHigh root 23223 2823  0 14:48 pts/0 00:00:00 grep tgtd
#
  
Actual results:
 * tgtd runs as initrc_t

Expected results:
 * tgtd runs in its own SELinux domain
Comment 1 Miroslav Grepl 2012-08-20 08:40:12 UTC 
I believe we should stay with initrc_t for all these services for RHEL5. 

Basically I can backport policies but we would need to make this policy as unconfined.

Also we don't see any issues with these services running as initrc.
Note You need to log in before you can comment on or make changes to this bug.