Bug 1405441

Summary:	ip6tables service on EL 7.3 fails to start due to invalid context file
Product:	Red Hat Enterprise Linux 7	Reporter:	Fabian Arrotin <fabian.arrotin>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.3	CC:	anrussel, iptables-maint-list, lvrabec, mgrepl, mmalik, plautrba, pvrabec, ssekidde, thomas.oulevey
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.13.1-124.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-01 15:20:12 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Fabian Arrotin 2016-12-16 14:09:08 UTC

Description of problem:

After having updated some nodes to 7.3 (but not rebooted) , ip6tables service doesn't (re)start as it has invalid context on the /var/lock/subsys/ip6tables

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.13.1-102.el7_3.7.noarch
iptables-services-1.4.21-17.el7.x86_64

How reproducible:

Have a el7.2 updated to 7.3, including a bump from those pkgs to newer versions:
selinux-policy-targeted-3.13.1-102.el7_3.7.noarch => selinux-policy-targeted-3.13.1-102.el7_3.7.noarch
iptables-services-1.4.21-16.el7.x86_64 => iptables-services-1.4.21-17.el7.x86_64


Actual results:
systemctl start ip6tables => fails

Expected results:
ip6tables service would succeed

Additional info:

on el7.2, the context for /var/lock/subsys/ip6tables was : 
-rw-r--r--. root root system_u:object_r:var_lock_t:s0  ip6tables

But it's now denied, so putting it to iptables_lock_t (like for iptables service) allow the service to start

Interesting : 
restorecon -Rv /var/lock/subsys/ip6tables 
restorecon:  Warning no default label for /run/lock/subsys/ip6tables

But a reboot seem to solve that issue (but rebooting a bunch of servers isn't the best idea either)

Comment 1 Thomas Woerner 2016-12-16 14:38:17 UTC

There has been no change in the iptables init script related to the subsys lock file path since 2004.

Comment 2 Thomas Woerner 2016-12-16 14:40:16 UTC

Reassigning to selinux-policy.

Comment 4 Milos Malik 2016-12-19 11:17:33 UTC

I believe this bug describes another aspect of the same problem as BZ#1376343 or BZ#1367520.

# matchpathcon /var/lock/subsys/iptables
/var/lock/subsys/iptables	system_u:object_r:iptables_lock_t:s0
# matchpathcon /var/lock/subsys/ip6tables
/var/lock/subsys/ip6tables	<<none>>
#

Comment 7 errata-xmlrpc 2017-08-01 15:20:12 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1861