-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
rhel-8.10
-
None
-
None
-
Moderate
-
rhel-security-selinux
-
None
-
False
-
False
-
-
None
-
None
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
-
x86_64
-
None
What were you trying to do that didn't work?
Running setroubleshootd in RHEL 8 has a process with an unconfined_service_t context:
system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 root 2634054 22.5 0.0 378344 88444 ? Sl 15:26 0:00 /usr/libexec/platform-python -Es /usr/share/setroubleshoot/SetroubleshootPrivileged.py
The python script file is labeled with usr_t (and usr_t transitions to unconfined):
-rwxr-xr-x. 1 root root system_u:object_r:usr_t:s0 1939 Nov 22 2023 SetroubleshootPrivileged.py
What is the impact of this issue to you?
Unsure if this is expected behavior or a bug. If it is expected then we should document it as an unconfined service
https://access.redhat.com/solutions/6714611
Please provide the package NVR for which the bug is seen:
setroubleshoot-server-3.3.26-6.el8.x86_64
How reproducible is this bug?:
Reproducible on RHEL 8 when setroubleshoot runs this script
Steps to reproduce
- Enable setroubleshoot (set active to yes and restart auditd service)
# vi /etc/audit/plugins.d/sedispatch.conf # service auditd restart
- Wait for a bit of time, and then check the processes for this SetroubleshootPrivileged.py
# ps -eFZ | grep setrouble system_u:system_r:setroubleshootd_t:s0 setroub+ 491791 1 31 134306 140192 0 11:11 ? 00:00:01 /usr/libexec/platform-python -Es /usr/sbin/setroubleshootd -f system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 root 491805 1 31 93015 86240 0 11:11 ? 00:00:00 /usr/libexec/platform-python -Es /usr/share/setroubleshoot/SetroubleshootPrivileged.py unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 491837 284592 0 3056 1260 0 11:11 pts/0 00:00:00 grep --color=auto setrouble
Expected results
I would expect this to be confined in some way, or documented that it should be unconfined.
Actual results
system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 root 491805 1 31 93015 86240 0 11:11 ? 00:00:00 /usr/libexec/platform-python -Es /usr/share/setroubleshoot/SetroubleshootPrivileged.py