Bug 1192810

Summary:	typo errors in filename transition rules
Product:	Red Hat Enterprise Linux 7	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Simon Sekidde <ssekidde>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	low	Docs Contact:
Priority:	low
Version:	7.1	CC:	lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.13.1-25.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-19 10:26:26 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Milos Malik 2015-02-15 14:02:54 UTC

Description of problem:
 * based on several AVCs mentioned in several selinux-policy bugs for Fedora
 * the AVC contain filenames like nm-dhclient-eth0.conf (exactly one '.')
 * filename transition rules in current policy contain many patterns like nm-dhclient.-eth0.conf (exactly two '.')

Version-Release number of selected component (if applicable):
selinux-policy-minimum-3.13.1-23.el7.noarch
selinux-policy-devel-3.13.1-23.el7.noarch
selinux-policy-targeted-3.13.1-23.el7.noarch
selinux-policy-sandbox-3.13.1-23.el7.noarch
selinux-policy-doc-3.13.1-23.el7.noarch
selinux-policy-3.13.1-23.el7.noarch
selinux-policy-mls-3.13.1-23.el7.noarch

How reproducible:
always

Steps to Reproduce:
# sesearch -c file -T | grep 'nm-dhclient\.' | head -n 10
type_transition puppetagent_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth0.conf"; 
type_transition init_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth5.conf"; 
type_transition authconfig_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth4.conf"; 
type_transition pegasus_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth1.conf"; 
type_transition unconfined_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth6.conf"; 
type_transition initrc_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth1.conf"; 
type_transition init_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth2.conf"; 
type_transition neutron_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth9.conf"; 
type_transition sysadm_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth8.conf"; 
type_transition puppetagent_t var_run_t : file NetworkManager_var_run_t "nm-dhclient.-eth8.conf"; 
# sesearch -c file -T | grep 'nm-dhclient\.' | wc -l
90
#

Expected results:
 * the first '.' is removed from the filename pattern

Comment 1 Milos Malik 2015-02-15 14:05:17 UTC

I believe the mistakes are generated by networkmanager_filetrans_named_content interface, which is defined in /usr/share/selinux/devel/include/contrib/networkmanager.if file.

Comment 6 errata-xmlrpc 2015-11-19 10:26:26 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2300.html