From d59475b77eb47e8270557f5828acf786cffcf8f8 Mon Sep 17 00:00:00 2001
From: Jakub Filak <jfilak@redhat.com>
Date: Thu, 7 May 2015 14:22:27 +0200
Subject: [ABRT PATCH] dumpers: avoid AVC when creating dump directories

dump-oops and dump-xorg forces libreport to create a new dump directory
owned by root and the group abrt. That requires querying passwd and
group which is not yet allowed by selinux-policy:
https://bugzilla.redhat.com/show_bug.cgi?id=1219464

This is a temporary patch for rhel-7.1.z

Signed-off-by: Jakub Filak <jfilak@redhat.com>
---
 src/plugins/abrt-dump-oops.c | 11 ++++++++++-
 src/plugins/abrt-dump-xorg.c | 11 ++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/plugins/abrt-dump-oops.c b/src/plugins/abrt-dump-oops.c
index 05cb728..2dc93c9 100644
--- a/src/plugins/abrt-dump-oops.c
+++ b/src/plugins/abrt-dump-oops.c
@@ -195,7 +195,16 @@ static unsigned create_oops_dump_dirs(GList *oops_list, unsigned oops_cnt)
             log("Not going to make dump directories world readable because PrivateReports is on");
 
         mode = DEFAULT_DUMP_DIR_MODE;
-        my_euid = 0;
+        /* Keep my_euid=-1, it produces dump directories owned by the user root
+         * and the group root.
+         *
+         * Using my_euid!=-1 forces libreport to read /etc/passwd and
+         * /etc/group which generates SELinux AVC.
+         */
+        /* my_euid = 0; */
+
+        if (geteuid() != 0)
+            error_msg_and_die("PrivateReports is on, you must run this tool as root.");
     }
 
     pid_t my_pid = getpid();
diff --git a/src/plugins/abrt-dump-xorg.c b/src/plugins/abrt-dump-xorg.c
index 434dc76..545db7f 100644
--- a/src/plugins/abrt-dump-xorg.c
+++ b/src/plugins/abrt-dump-xorg.c
@@ -88,7 +88,16 @@ static void save_bt_to_dump_dir(const char *bt, const char *exe, const char *rea
             log("Not going to make dump directories world readable because PrivateReports is on");
 
         mode = DEFAULT_DUMP_DIR_MODE;
-        my_euid = 0;
+        /* Keep my_euid=-1, it produces dump directories owned by the user root
+         * and the group root.
+         *
+         * Using my_euid!=-1 forces libreport to read /etc/passwd and
+         * /etc/group which generates SELinux AVC.
+         */
+        /* my_euid = 0; */
+
+        if (geteuid() != 0)
+            error_msg_and_die("PrivateReports is on, you must run this tool as root.");
     }
 
     pid_t my_pid = getpid();
-- 
1.8.3.1