Bug 1470701
| Summary: | Switching from Targeted to MLS shows "denied" AVCs after reboot | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Renaud Métrich <rmetrich> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.3 | CC: | lvrabec, mgrepl, mmalik, plautrba, pvrabec, ruckc, ssekidde |
| Target Milestone: | rc | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 12:34:36 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Renaud Métrich
2017-07-13 13:38:26 UTC
Hi, Di you follow these instructions? Because if you switching to MLS you should do restorecon. Please try it again with following tutorial: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/enabling-mls-in-selinux.html If you have still some issues, feel free to re-open this BZ. I followed the instructions. There is no restorecon command to issue, but the autorelabel. As written, relabelling occurs during reboot but fails partially. Okay, Could you run fixfiles instead of autorelabel? # fixfiles -F onboot Thanks. This is what I did since I followed the RHEL7 guide. From the relabelling traces, some invalid context issues appear (see the description). just ran into these today, when trying to test the MLS policies in RHEL 7, versus RHEL 6. Seems like most of this should be caught before getting released. Also catches me in kind of a bind, as it appears most of these appear because the scontext isn't getting set correctly. I'd be tempted to write a module to address these, but allowing permissions to services properly typed is one thing, and improperly typed is quite another. I tried switch RHEL-7.4 and RHEL-7.3 systems to MLS using: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/mls.html Systems are booting fine in Enforcing. MLS policy type is too strictly so some AVCs during boot are expected. I prefer close this and use local policy for fixing AVCS. Messages like "Context unconfined_u:.* is not valid" are expected, because unconfined_u is not defined in MLS policy:
# seinfo -uunconfined_u -x /etc/selinux/targeted/policy/policy.30
unconfined_u
default level: s0
range: s0 - s0:c0.c1023
roles:
object_r
system_r
unconfined_r
# seinfo -uunconfined_u -x /etc/selinux/mls/policy/policy.30
ERROR: could not find datum for user unconfined_u
#
After switching to MLS, you can see a lot SELinux denials, because the MLS policy supports only a subset of domains supported in the targeted policy. Of course, this can improve in future. The documentation cited in comment#0 says: 7. If there were no denial messages in the /var/log/messages file, or you have resolved all existing denials, configure SELINUX=enforcing in the /etc/selinux/config file... The "if" part of the sentence is not necessary. The "configure ..." part is enough. The machine is able to boot in MLS enforcing even if there are some SELinux denials. Based on the tests I ran, there are no SELinux denials which contain unlabeled_t. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763 |