Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-122379

SetroubleshootPrivileged.py has unconfined_service_t context

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • rhel-8.10
    • setroubleshoot
    • None
    • None
    • Moderate
    • rhel-security-selinux
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • x86_64
    • None

      What were you trying to do that didn't work?

      Running setroubleshootd in RHEL 8 has a process with an unconfined_service_t context:
      system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 root 2634054 22.5 0.0 378344 88444 ? Sl 15:26 0:00 /usr/libexec/platform-python -Es /usr/share/setroubleshoot/SetroubleshootPrivileged.py
      The python script file is labeled with usr_t (and usr_t transitions to unconfined):

      -rwxr-xr-x.   1 root root system_u:object_r:usr_t:s0                       1939 Nov 22  2023 SetroubleshootPrivileged.py

      What is the impact of this issue to you?

       

      Unsure if this is expected behavior or a bug.  If it is expected then we should document it as an unconfined service
      https://access.redhat.com/solutions/6714611

      Please provide the package NVR for which the bug is seen:

      setroubleshoot-server-3.3.26-6.el8.x86_64

      How reproducible is this bug?:

      Reproducible on RHEL 8 when setroubleshoot runs this script

      Steps to reproduce

      1.  Enable setroubleshoot (set active to yes and restart auditd service)
      # vi /etc/audit/plugins.d/sedispatch.conf
      # service auditd restart
      1.  Wait for a bit of time, and then check the processes for this SetroubleshootPrivileged.py
      # ps -eFZ | grep setrouble 
      system_u:system_r:setroubleshootd_t:s0 setroub+ 491791 1 31 134306 140192 0 11:11 ?        00:00:01 /usr/libexec/platform-python -Es /usr/sbin/setroubleshootd -f 
      system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 root 491805 1 31 93015 86240 0 11:11 ? 00:00:00 /usr/libexec/platform-python -Es /usr/share/setroubleshoot/SetroubleshootPrivileged.py 
      unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 491837 284592  0 3056 1260 0 11:11 pts/0 00:00:00 grep --color=auto setrouble

      Expected results

      I would expect this to be confined in some way, or documented that it should be unconfined.

      Actual results

       

      system_u:system_r:unconfined_service_t:s0-s0:c0.c1023 root 491805 1 31 93015 86240 0 11:11 ? 00:00:00 /usr/libexec/platform-python -Es /usr/share/setroubleshoot/SetroubleshootPrivileged.py

              vmojzis@redhat.com Vit Mojzis
              rhn-support-ckrell Charlie Krell
              Vit Mojzis Vit Mojzis
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: