| Summary: |
policy contains allow rules which collide with neverallow rules |
| Product: |
Red Hat Enterprise Linux 7
|
Reporter: |
Milos Malik <mmalik> |
| Component: |
selinux-policy | Assignee: |
Lukas Vrabec <lvrabec> |
| Status: |
CLOSED
WONTFIX
|
QA Contact: |
Milos Malik <mmalik> |
| Severity: |
high
|
Docs Contact: |
|
| Priority: |
high
|
|
|
| Version: |
7.4 | CC: |
aperotti, ayadav, cww, lvrabec, mgrepl, mmalik, plautrba, pvrabec, rmetrich, ssekidde
|
| Target Milestone: |
rc | |
|
| Target Release: |
--- | |
|
| Hardware: |
All | |
|
| OS: |
Linux | |
|
| Whiteboard: |
|
|
Fixed In Version:
|
|
Doc Type:
|
If docs needed, set a value
|
|---|
|
Doc Text:
|
|
Story Points:
|
---
|
|---|
|
Clone Of:
|
|
|---|
|
:
|
1565079
(view as bug list) |
Environment:
|
|
|
Last Closed:
|
2018-04-09 10:54:37 UTC
|
Type:
|
Bug
|
|---|
|
Regression:
|
---
|
Mount Type:
|
---
|
|---|
|
Documentation:
|
---
|
CRM:
|
|
|---|
|
Verified Versions:
|
|
Category:
|
---
|
|---|
|
oVirt Team:
|
---
|
RHEL 7.3 requirements from Atomic Host:
|
|
|---|
|
Cloudforms Team:
|
---
|
Target Upstream Version:
|
|
|---|
|
Embargoed:
|
|
| |
|---|
| Bug Depends On: |
|
|
|
| Bug Blocks: |
1477664, 1565079
|
|
|
Description of problem: * the fact that expand-check is disabled by default in /etc/selinux/semanage.conf hides a problem that policy allows actions which should not be allowed * are these collisions tolerated / expected? Version-Release number of selected component (if applicable): selinux-policy-devel-3.13.1-166.el7.noarch selinux-policy-targeted-3.13.1-166.el7.noarch selinux-policy-3.13.1-166.el7.noarch How reproducible: * always Steps to Reproduce: # grep expand-check= /etc/selinux/semanage.conf expand-check=1 # semodule -B neverallow check failed at /etc/selinux/targeted/tmp/modules/100/selinuxutil/cil:245 (neverallow selinuxutil_typeattr_1 semanage_store_t (file (relabelto))) <root> allow at /etc/selinux/targeted/tmp/modules/100/selinuxutil/cil:676 (allow restorecond_t non_auth_file_type (file (getattr relabelfrom relabelto))) <root> allow at /etc/selinux/targeted/tmp/modules/100/systemd/cil:1128 (allow systemd_tmpfiles_t non_auth_file_type (file (getattr relabelfrom relabelto))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13163 (neverallow base_typeattr_18 scsi_generic_device_t (blk_file (read))) <root> allow at /etc/selinux/targeted/tmp/modules/100/munin/cil:581 (allow disk_munin_plugin_t device_node (blk_file (ioctl read getattr lock open))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13161 (neverallow base_typeattr_17 fixed_disk_device_t (blk_file (write append))) <root> allow at /etc/selinux/targeted/tmp/modules/100/cmirrord/cil:105 (allow cmirrord_t fixed_disk_device_t (blk_file (read write))) <root> allow at /etc/selinux/targeted/tmp/modules/100/dbus/cil:219 (allow system_dbusd_t fixed_disk_device_t (blk_file (read write))) <root> allow at /etc/selinux/targeted/tmp/modules/100/oracleasm/cil:132 (allow oracleasm_t fixed_disk_device_t (blk_file (read write))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13160 (neverallow base_typeattr_17 fixed_disk_device_t (chr_file (write append))) <root> allow at /etc/selinux/targeted/tmp/modules/100/cmirrord/cil:104 (allow cmirrord_t fixed_disk_device_t (chr_file (read write))) <root> allow at /etc/selinux/targeted/tmp/modules/100/dbus/cil:218 (allow system_dbusd_t fixed_disk_device_t (chr_file (read write))) <root> allow at /etc/selinux/targeted/tmp/modules/100/oracleasm/cil:131 (allow oracleasm_t fixed_disk_device_t (chr_file (read write))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13159 (neverallow base_typeattr_16 fixed_disk_device_t (blk_file (read))) <root> allow at /etc/selinux/targeted/tmp/modules/100/dbus/cil:219 (allow system_dbusd_t fixed_disk_device_t (blk_file (read write))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:13158 (neverallow base_typeattr_16 fixed_disk_device_t (chr_file (read))) <root> allow at /etc/selinux/targeted/tmp/modules/100/dbus/cil:218 (allow system_dbusd_t fixed_disk_device_t (chr_file (read write))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:8901 (neverallow base_typeattr_11 proc_kcore_t (file (ioctl read write create setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton execute_no_trans entrypoint execmod open audit_access))) <root> allow at /etc/selinux/targeted/tmp/modules/100/abrt/cil:296 (allow abrt_t proc_type (file (ioctl read getattr lock open))) <root> allow at /etc/selinux/targeted/tmp/modules/100/collectd/cil:207 (allow collectd_t proc_type (file (ioctl read getattr lock open))) <root> allow at /etc/selinux/targeted/tmp/modules/100/snmp/cil:190 (allow snmpd_t proc_type (file (ioctl read getattr lock open))) <root> allow at /etc/selinux/targeted/tmp/modules/100/sysadm/cil:1266 (allow sysadm_t proc_type (file (ioctl read getattr lock open))) <root> allow at /etc/selinux/targeted/tmp/modules/100/virt/cil:1933 (allow svirt_sandbox_domain proc_type (file (ioctl read getattr lock open))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:8900 (neverallow base_typeattr_10 proc_kmsg_t (file (ioctl read write create setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton execute_no_trans entrypoint execmod open audit_access))) <root> allow at /etc/selinux/targeted/tmp/modules/100/abrt/cil:296 (allow abrt_t proc_type (file (ioctl read getattr lock open))) <root> allow at /etc/selinux/targeted/tmp/modules/100/collectd/cil:207 (allow collectd_t proc_type (file (ioctl read getattr lock open))) <root> allow at /etc/selinux/targeted/tmp/modules/100/snmp/cil:190 (allow snmpd_t proc_type (file (ioctl read getattr lock open))) <root> allow at /etc/selinux/targeted/tmp/modules/100/sysadm/cil:1266 (allow sysadm_t proc_type (file (ioctl read getattr lock open))) <root> allow at /etc/selinux/targeted/tmp/modules/100/virt/cil:1933 (allow svirt_sandbox_domain proc_type (file (ioctl read getattr lock open))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:8897 (neverallow base_typeattr_9 self (capability (sys_module))) <root> allow at /etc/selinux/targeted/tmp/modules/100/openvswitch/cil:107 (allow openvswitch_t self (capability (chown setgid setuid setpcap net_admin ipc_lock sys_module sys_rawio sys_nice sys_resource))) <root> booleanif at /etc/selinux/targeted/tmp/modules/100/virt/cil:2727 true at /etc/selinux/targeted/tmp/modules/100/virt/cil:2728 allow at /etc/selinux/targeted/tmp/modules/100/virt/cil:2730 (allow svirt_lxc_net_t self (capability (chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:4512 (neverallow base_typeattr_5 self (process (setcurrent))) <root> allow at /etc/selinux/targeted/tmp/modules/100/seunshare/cil:34 (allow seunshare_domain self (process (fork signal setsched getcap setcap setexec setcurrent))) neverallow check failed at /etc/selinux/targeted/tmp/modules/100/base/cil:4496 (neverallow base_typeattr_1 memory_device_t (blk_file (read))) <root> allow at /etc/selinux/targeted/tmp/modules/100/munin/cil:581 (allow disk_munin_plugin_t device_node (blk_file (ioctl read getattr lock open))) Failed to generate binary semodule: Failed! # Expected results: * no collisions when expand-check is enabled Additional information: * the same problem appears on RHEL-7.3