Bug 1398853

Summary:	SELinux file context for /usr/lib/systemd/resolv.conf should be net_conf_t
Product:	[Fedora] Fedora	Reporter:	Anthony Messina <amessina>
Component:	selinux-policy-targeted	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Ben Levenson <benl>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	25	CC:	dwalsh
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-12-08 18:23:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Anthony Messina 2016-11-26 16:31:51 UTC

According to the systemd-resolved man page

"A static file /usr/lib/systemd/resolv.conf is provided that lists the 127.0.0.53 DNS stub (see above) as only DNS server. This file may be symlinked from /etc/resolv.conf in order to connect all local clients that bypass local DNS APIs to systemd-resolved. This mode of operation is recommended."

In order for this to work properly, the SELinux file context for /usr/lib/systemd/resolv.conf should be net_conf_t so other daemons are allowed to access it via the symlink (similar to the label fix a while back for /run/systemd/resolve/resolv.conf)

$ ls -l /etc/resolv.conf 
lrwxrwxrwx. 1 root root 28 Nov 25 20:23 /etc/resolv.conf -> /usr/lib/systemd/resolv.conf

Comment 1 Daniel Walsh 2016-11-28 17:51:28 UTC

Should other domains including NetworkManager_t be allowed to write it?  If not, it would probably be better labeled usr_t.

Comment 2 Anthony Messina 2016-11-28 19:33:47 UTC

(In reply to Daniel Walsh from comment #1)
> Should other domains including NetworkManager_t be allowed to write it?  If
> not, it would probably be better labeled usr_t.

Other domains probably shouldn't be messing with it. This is just a workaround which reduced the AVCs (that have to be allowed) until Fedora's SELinux policies can catch up (hopefully very soon) to systemd's tools.

One thing that systemd is fond of is symlinks, which many of the previously existing domain policies don't like -- Postfix for example.

Comment 3 Daniel Walsh 2016-11-28 21:25:34 UTC

If we labeled it usr_t or even lib_t then all these domains could read it but not modify it.

Sadly we currently label it init_exec_t, which is no good.

Comment 4 Anthony Messina 2016-11-29 00:30:35 UTC

(In reply to Daniel Walsh from comment #3)
> If we labeled it usr_t or even lib_t then all these domains could read it
> but not modify it.
> 
> Sadly we currently label it init_exec_t, which is no good.

https://github.com/fedora-selinux/selinux-policy/commit/55636311de67f0782fde3d89ea82559d16c2c3ca

This should get closer.  Regardless of the label, won't other policy prevent the symlink from /etc/resolve.conf to /usr/lib/systemd/resolv.conf or /run/systemd/resolve/resolv.conf, the latter of which is defaulted to net_conf_t?  It seems a lot of things will need lnk_file support.

Comment 5 Daniel Walsh 2016-11-29 15:05:03 UTC

No I think all domains that need to read /etc/resolv.conf already can read a link file that is labeled as net_conf_t,  The problem is they can not read a file with a label of init_exec_t.  Changing this label to net_conf_t allows the access but it also allows all domains that can write to net_conf_t to be allowed to write to the file, from an SELinux point of view.  Getting this to a label like lib_t or usr_t, would solve both problems.  In that all domains that need to read /etc/resolv.conf can now read the file, but domains that can write /etc/resolv.conf will NOT be allowed to write /usr/lib/systemd/resolv.conf

Comment 6 Fedora Update System 2016-11-29 17:04:51 UTC

selinux-policy-3.13.1-225.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-9d027c3768

Comment 7 Fedora Update System 2016-12-03 04:31:59 UTC

selinux-policy-3.13.1-225.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-9d027c3768

Comment 8 Fedora Update System 2016-12-05 17:03:22 UTC

selinux-policy-3.13.1-225.1.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-e3864b8972

Comment 9 Fedora Update System 2016-12-07 02:26:11 UTC

selinux-policy-3.13.1-225.1.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-e3864b8972

Comment 10 Fedora Update System 2016-12-08 18:23:19 UTC

selinux-policy-3.13.1-225.1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.