Bug 1024963
| Summary: | lost+found SELinux context | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Julio Entrena Perez <jentrena> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.4 | CC: | dwalsh, gasmith, jentrena, ssekidde |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-11-11 17:17:10 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
When we have generic content we label it it lost_found_t. When it is on a file sytstem with all the same labels it label it with the label of that directory. It is arguable whether or not we should have any label for this any longer. This is not a bug. lost+found should be labeled after the content that is likely to be in those directories. |
Description of problem: A customer is mounting a filesystem under /var/lib/pgsql in their Satellite 5.6 and database installation fails with "The directory /var/lib/pgsql does not seem to have correct SELinux context." As per /usr/bin/spacewalk-setup-postgresql line 109 will cause 'restorecon' to report any entry which does not have the expected security context (according to the current policy) and line 110 will indeed stop the installation if output of line 109 is not empty: 104 if [ ! -d "$PG_DATA/base" ] ; then 105 if /usr/sbin/selinuxenabled; then 106 SEMODE=$(/usr/sbin/getenforce) 107 if [ "$SEMODE" = 'Permissive' -o "$SEMODE" = 'Enforcing' ]; then 108 PGHOME=$(getent passwd postgres | awk -F: '{print $6}') 109 RCONOUT=$(/sbin/restorecon -Rnv $PGHOME) 110 if [ -n "$RCONOUT" ]; then 111 echo 112 echo "The directory \"$PGHOME\" does not seem to have correct SELinux context." 113 echo 114 echo "Please fix the SELinux context by running:" 115 echo 116 echo " restorecon -Rv $PGHOME" 117 echo 118 exit 1 119 fi 120 fi 121 fi 122 postgresql_service initdb 123 fi The problem is triggered by the "lost+found" directory which has "system_u:object_r:lost_found_t:s0" security context but, according to the policy (targeted-3.7.19-195.el6), should have "system_u:object_r:postgresql_db_t:s0" instead: # ls -ldZ /var/lib/pgsql drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 /var/lib/pgsql # # ls -lZ /var/lib/pgsql drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 backups drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 data drwx------. root root system_u:object_r:lost_found_t:s0 lost+found <--- -rw-------. postgres postgres unconfined_u:object_r:postgresql_log_t:s0 pgstartup.log # semanage fcontext -l | grep lost # semanage fcontext -l | grep pgsql Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-195.el6 How reproducible: Always. Steps to Reproduce: 1. Mount a filesystem in a location other than /, /boot, /tmp, /usr, /var and /var/tmp (so none of the policy rules for lost+found apply, see "semanage fcontext -l | grep lost"). 2. Run "restorecon -Rv" in the location where the filesystem has been mounted. 3. Actual results: lost+found directory ends with whatever context the policy mandates for that location. Expected results: lost+found directory ends with "system_u:object_r:lost_found_t:s0" context. Additional info: