Bug 1530601
| Summary: | SELinux filecontext for /var/lock/ppp is not set upon package installation | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Renaud Métrich <rmetrich> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.4 | CC: | jreznik, lvrabec, mgrepl, mmalik, msekleta, mthacker, pgozart, plautrba, ssekidde |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.13.1-187.el7 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-10 12:47:26 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Renaud Métrich
2018-01-03 13:09:38 UTC
There is no type_transition rule in the policy that would ensure that /var/lock/ppp gets a correct context when it's created:
# sesearch -T | grep pppd_lock_t
#
If there was such a rule, the /var/lock/ppp directory would be labeled correctly by rpm/yum during the installation of ppp package.
# ls -dZ /var/lock/ppp
ls: cannot access /var/lock/ppp: No such file or directory
# yum -y install ppp
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
Resolving Dependencies
--> Running transaction check
---> Package ppp.x86_64 0:2.4.5-33.el7 will be installed
--> Finished Dependency Resolution
Dependencies Resolved
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
ppp x86_64 2.4.5-33.el7 rhel 357 k
Transaction Summary
================================================================================
Install 1 Package
Total download size: 357 k
Installed size: 852 k
Downloading packages:
ppp-2.4.5-33.el7.x86_64.rpm | 357 kB 00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Installing : ppp-2.4.5-33.el7.x86_64 1/1
Verifying : ppp-2.4.5-33.el7.x86_64 1/1
Installed:
ppp.x86_64 0:2.4.5-33.el7
Complete!
# ls -dZ /var/lock/ppp
drwxr-xr-x. root root unconfined_u:object_r:pppd_lock_t:s0 /var/lock/ppp
#
Following policy module brings such a rule:
# cat mypolicy.te
policy_module(mypolicy,1.0)
require {
type rpm_t;
type rpm_script_t;
type unconfined_t;
type var_lock_t;
type pppd_lock_t;
}
type_transition rpm_t var_lock_t : dir pppd_lock_t "ppp";
type_transition rpm_script_t var_lock_t : dir pppd_lock_t "ppp";
type_transition unconfined_t var_lock_t : dir pppd_lock_t "ppp";
#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763 |