Bug 1362041

Summary:	semanage fcontext reports invalid regex, but file_contexts.local is affected by the command
Product:	[Fedora] Fedora	Reporter:	Vit Mojzis <vmojzis>
Component:	policycoreutils	Assignee:	Vit Mojzis <vmojzis>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	23	CC:	dwalsh, mgrepl, plautrba
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	policycoreutils-2.5-17.fc25	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-10-10 17:43:56 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Vit Mojzis 2016-08-01 08:52:22 UTC

Description of problem:
semanage fcontext reports invalid regex, but /etc/selinux/targeted/contexts/files/file_contexts.local is still affected by the command

Version-Release number of selected component (if applicable):

policycoreutils-2.4-21.fc23.x86_64


How reproducible:

Steps to Reproduce:
1. $sudo semanage fcontext -a -t httpd_sys_content_t "(/.*)?"

Actual results:

/etc/selinux/targeted/contexts/files/file_contexts.local:  line 5 has invalid regex (/.*)?:  out of memory
PCRE study failed for ^(/.*)?$: (null)
libsemanage.sefcontext_compile: sefcontext_compile returned error code 255. Compiling /etc/selinux/targeted/contexts/files/file_contexts.local (No such file or directory).
/etc/selinux/targeted/contexts/files/file_contexts.local:  line 5 has invalid regex (/.*)?:  out of memory
PCRE study failed for ^(/.*)?$: (null)
libsemanage.sefcontext_compile: sefcontext_compile returned error code 255. Compiling /etc/selinux/targeted/contexts/files/file_contexts.local (No such file or directory).
FileNotFoundError: [Errno 2] No such file or directory


Expected results:
-

Comment 1 Vit Mojzis 2016-08-12 10:43:30 UTC

Before moving new version of policy (containing requested changes) to the binary policy path (semanage_install_final_tmp - semanage_store.c), current policy is backed up (so that when new policy fails to compile, changes can be undone). (This process takes place in semanage_commit_sandbox).
However the backup doesn't contain "file_contexts.local" and therefore is useless in this case.


Specifically, the backup process deals with the following paths:
   backup
    "/var/lib/selinux/targeted/previous"
 
   sandbox
    "/var/lib/selinux/targeted/tmp"
 
   active
    "/var/lib/selinux/targeted/active"

And semanage_install_final_tmp deals with:
   src: (probably should be contained in "active" path above)
    "/var/lib/selinux/tmp/targeted/contexts/files/file_contexts"
   dst:
    "/etc/selinux/targeted/contexts/files/file_contexts"

Upon failure of semanage_install_final_tmp, the backup is retrieved (backup -> active), but this change doesn't influence the paths that semanage_install_final_tmp deals with and the system is left with invalid "/etc/selinux/targeted/contexts/files/file_contexts.local" file (that is why the error message is repeated twice - semanage_install_final_tmp is run 2 times on the same set of files).

Comment 2 Vit Mojzis 2016-08-26 13:15:08 UTC

The issue is solved on upstream and the fix will propagate to fedora branch during next rebase.

https://github.com/SELinuxProject/selinux/commit/a7334eb0de98af11ec38b6263536fa01bc2a606c			https://github.com/SELinuxProject/selinux/commit/6e2bdb770f6311060b111e87bd7af653e225be9d

Comment 3 Fedora Update System 2016-10-05 20:29:38 UTC

checkpolicy-2.5-8.fc25, libselinux-2.5-12.fc25, libsemanage-2.5-8.fc25, libsepol-2.5-10.fc25, policycoreutils-2.5-17.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-b7e8e980ef

Comment 4 Fedora Update System 2016-10-06 20:59:10 UTC

checkpolicy-2.5-8.fc25, libselinux-2.5-12.fc25, libsemanage-2.5-8.fc25, libsepol-2.5-10.fc25, policycoreutils-2.5-17.fc25, secilc-2.5-6.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-b7e8e980ef

Comment 5 Fedora Update System 2016-10-10 17:43:56 UTC

checkpolicy-2.5-8.fc25, libselinux-2.5-12.fc25, libsemanage-2.5-8.fc25, libsepol-2.5-10.fc25, policycoreutils-2.5-17.fc25, secilc-2.5-6.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.