Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionJulio Entrena Perez
2013-10-30 16:32:02 UTC
Description of problem:
A customer is mounting a filesystem under /var/lib/pgsql in their Satellite 5.6 and database installation fails with "The directory /var/lib/pgsql does not seem to have correct SELinux context."
As per /usr/bin/spacewalk-setup-postgresql line 109 will cause 'restorecon' to report any entry which does not have the expected security context (according to the current policy) and line 110 will indeed stop the installation if output of line 109 is not empty:
104 if [ ! -d "$PG_DATA/base" ] ; then
105 if /usr/sbin/selinuxenabled; then
106 SEMODE=$(/usr/sbin/getenforce)
107 if [ "$SEMODE" = 'Permissive' -o "$SEMODE" = 'Enforcing' ]; then
108 PGHOME=$(getent passwd postgres | awk -F: '{print $6}')
109 RCONOUT=$(/sbin/restorecon -Rnv $PGHOME)
110 if [ -n "$RCONOUT" ]; then
111 echo
112 echo "The directory \"$PGHOME\" does not seem to have correct SELinux context."
113 echo
114 echo "Please fix the SELinux context by running:"
115 echo
116 echo " restorecon -Rv $PGHOME"
117 echo
118 exit 1
119 fi
120 fi
121 fi
122 postgresql_service initdb
123 fi
The problem is triggered by the "lost+found" directory which has "system_u:object_r:lost_found_t:s0" security context but, according to the policy (targeted-3.7.19-195.el6), should have "system_u:object_r:postgresql_db_t:s0" instead:
# ls -ldZ /var/lib/pgsql
drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 /var/lib/pgsql
#
# ls -lZ /var/lib/pgsql
drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 backups
drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 data
drwx------. root root system_u:object_r:lost_found_t:s0 lost+found <---
-rw-------. postgres postgres unconfined_u:object_r:postgresql_log_t:s0 pgstartup.log
# semanage fcontext -l | grep lost
# semanage fcontext -l | grep pgsql
Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.7.19-195.el6
How reproducible:
Always.
Steps to Reproduce:
1. Mount a filesystem in a location other than /, /boot, /tmp, /usr, /var and /var/tmp (so none of the policy rules for lost+found apply, see "semanage fcontext -l | grep lost").
2. Run "restorecon -Rv" in the location where the filesystem has been mounted.
3.
Actual results:
lost+found directory ends with whatever context the policy mandates for that location.
Expected results:
lost+found directory ends with "system_u:object_r:lost_found_t:s0" context.
Additional info:
When we have generic content we label it it lost_found_t. When it is on a file sytstem with all the same labels it label it with the label of that directory.
It is arguable whether or not we should have any label for this any longer.
Description of problem: A customer is mounting a filesystem under /var/lib/pgsql in their Satellite 5.6 and database installation fails with "The directory /var/lib/pgsql does not seem to have correct SELinux context." As per /usr/bin/spacewalk-setup-postgresql line 109 will cause 'restorecon' to report any entry which does not have the expected security context (according to the current policy) and line 110 will indeed stop the installation if output of line 109 is not empty: 104 if [ ! -d "$PG_DATA/base" ] ; then 105 if /usr/sbin/selinuxenabled; then 106 SEMODE=$(/usr/sbin/getenforce) 107 if [ "$SEMODE" = 'Permissive' -o "$SEMODE" = 'Enforcing' ]; then 108 PGHOME=$(getent passwd postgres | awk -F: '{print $6}') 109 RCONOUT=$(/sbin/restorecon -Rnv $PGHOME) 110 if [ -n "$RCONOUT" ]; then 111 echo 112 echo "The directory \"$PGHOME\" does not seem to have correct SELinux context." 113 echo 114 echo "Please fix the SELinux context by running:" 115 echo 116 echo " restorecon -Rv $PGHOME" 117 echo 118 exit 1 119 fi 120 fi 121 fi 122 postgresql_service initdb 123 fi The problem is triggered by the "lost+found" directory which has "system_u:object_r:lost_found_t:s0" security context but, according to the policy (targeted-3.7.19-195.el6), should have "system_u:object_r:postgresql_db_t:s0" instead: # ls -ldZ /var/lib/pgsql drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 /var/lib/pgsql # # ls -lZ /var/lib/pgsql drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 backups drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 data drwx------. root root system_u:object_r:lost_found_t:s0 lost+found <--- -rw-------. postgres postgres unconfined_u:object_r:postgresql_log_t:s0 pgstartup.log # semanage fcontext -l | grep lost # semanage fcontext -l | grep pgsql Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-195.el6 How reproducible: Always. Steps to Reproduce: 1. Mount a filesystem in a location other than /, /boot, /tmp, /usr, /var and /var/tmp (so none of the policy rules for lost+found apply, see "semanage fcontext -l | grep lost"). 2. Run "restorecon -Rv" in the location where the filesystem has been mounted. 3. Actual results: lost+found directory ends with whatever context the policy mandates for that location. Expected results: lost+found directory ends with "system_u:object_r:lost_found_t:s0" context. Additional info: