From d59475b77eb47e8270557f5828acf786cffcf8f8 Mon Sep 17 00:00:00 2001 From: Jakub Filak Date: Thu, 7 May 2015 14:22:27 +0200 Subject: [ABRT PATCH] dumpers: avoid AVC when creating dump directories dump-oops and dump-xorg forces libreport to create a new dump directory owned by root and the group abrt. That requires querying passwd and group which is not yet allowed by selinux-policy: https://bugzilla.redhat.com/show_bug.cgi?id=1219464 This is a temporary patch for rhel-7.1.z Signed-off-by: Jakub Filak --- src/plugins/abrt-dump-oops.c | 11 ++++++++++- src/plugins/abrt-dump-xorg.c | 11 ++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/src/plugins/abrt-dump-oops.c b/src/plugins/abrt-dump-oops.c index 05cb728..2dc93c9 100644 --- a/src/plugins/abrt-dump-oops.c +++ b/src/plugins/abrt-dump-oops.c @@ -195,7 +195,16 @@ static unsigned create_oops_dump_dirs(GList *oops_list, unsigned oops_cnt) log("Not going to make dump directories world readable because PrivateReports is on"); mode = DEFAULT_DUMP_DIR_MODE; - my_euid = 0; + /* Keep my_euid=-1, it produces dump directories owned by the user root + * and the group root. + * + * Using my_euid!=-1 forces libreport to read /etc/passwd and + * /etc/group which generates SELinux AVC. + */ + /* my_euid = 0; */ + + if (geteuid() != 0) + error_msg_and_die("PrivateReports is on, you must run this tool as root."); } pid_t my_pid = getpid(); diff --git a/src/plugins/abrt-dump-xorg.c b/src/plugins/abrt-dump-xorg.c index 434dc76..545db7f 100644 --- a/src/plugins/abrt-dump-xorg.c +++ b/src/plugins/abrt-dump-xorg.c @@ -88,7 +88,16 @@ static void save_bt_to_dump_dir(const char *bt, const char *exe, const char *rea log("Not going to make dump directories world readable because PrivateReports is on"); mode = DEFAULT_DUMP_DIR_MODE; - my_euid = 0; + /* Keep my_euid=-1, it produces dump directories owned by the user root + * and the group root. + * + * Using my_euid!=-1 forces libreport to read /etc/passwd and + * /etc/group which generates SELinux AVC. + */ + /* my_euid = 0; */ + + if (geteuid() != 0) + error_msg_and_die("PrivateReports is on, you must run this tool as root."); } pid_t my_pid = getpid(); -- 1.8.3.1