Bug 989480 - secalert: glusterfs-fuse: File /usr/bin/fusermount-glusterfs on x86_64 is setuid root but is not on the setxid whitelist
secalert: glusterfs-fuse: File /usr/bin/fusermount-glusterfs on x86_64 is set...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: glusterfs (Show other bugs)
6.5
Unspecified Unspecified
unspecified Severity urgent
: rc
: ---
Assigned To: Amar Tumballi
Cluster QE
:
Depends On:
Blocks: 993270
  Show dependency treegraph
 
Reported: 2013-07-29 06:50 EDT by Bala.FA
Modified: 2015-11-22 21:57 EST (History)
5 users (show)

See Also:
Fixed In Version: glusterfs-3.4.0.22rhs-2
Doc Type: Bug Fix
Doc Text:
Cause: errata tool reports security alert for file /usr/bin/fusermount-glusterfs on which setuid bit for root is set, but it is not on the setxid whitelist Consequence: attaching build to errata fails in rpmdiff test Fix: remove setuid bit set for /usr/bin/fusermount-glusterfs Result: now rpmdiff doesn't report failure and the security alert has been removed
Story Points: ---
Clone Of:
: 993270 (view as bug list)
Environment:
Last Closed: 2013-11-21 06:58:51 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Bala.FA 2013-07-29 06:50:24 EDT
errata tool reports secalert for glusterfs-fuse

File /usr/bin/fusermount-glusterfs on x86_64 is setuid root but is not on the setxid whitelist
Comment 1 Amar Tumballi 2013-07-29 14:04:16 EDT
Bala, looks like '/usr/bin/fusermount' from package 'fuse' also has same setxid bits enabled. We just need fusermount-glusterfs to be added to the whitelist then.

-Amar
Comment 2 Amar Tumballi 2013-08-23 14:24:01 EDT
Issue fixed with fixing the modes.
Comment 4 Amar Tumballi 2013-10-09 01:22:04 EDT
Steps to check:

On any glusterfs version (not on RHS or on RHS, before glusterfs-3.4.0.10rhs)
amar@ganaka:~/work/rhs-glusterfs$ ls -l /usr/bin/fusermount-glusterfs
-rwsr-xr-x 1 root root 102192 Oct  5 00:03 /usr/local/bin/fusermount-glusterfs

with latest rhs, you don't see the setuid set on the file. (ie, no 's' in the mode bits).
Comment 5 Gowrishankar Rajaiyan 2013-10-09 02:23:48 EDT
[root@dhcp201-162 ~]# ls -l /usr/bin/fusermount-glusterfs
-rwxr-xr-x. 1 root root 28304 Oct  8 11:35 /usr/bin/fusermount-glusterfs
[root@dhcp201-162 ~]# 

[root@dhcp201-162 ~]# rpm -qf  /usr/bin/fusermount-glusterfs
glusterfs-fuse-3.4.0.34rhs-1.el6.x86_64
[root@dhcp201-162 ~]# 

Verified.
Comment 6 errata-xmlrpc 2013-11-21 06:58:51 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1641.html

Note You need to log in before you can comment on or make changes to this bug.