Bug 1595572

Summary: sesearch -b fails when old boolean name (defined in /etc/selinux/*/booleans.subs_dist) is used
Product: Red Hat Enterprise Linux 8 Reporter: Milos Malik <mmalik>
Component: setoolsAssignee: Vit Mojzis <vmojzis>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: medium    
Version: 8.0CC: lvrabec, mmalik, plautrba, vmojzis
Target Milestone: rcKeywords: Triaged
Target Release: 8.2Flags: pm-rhel: mirror+
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-04 02:00:12 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1682508    
Bug Blocks:    

Description Milos Malik 2018-06-27 07:45:29 UTC 
Description of problem:

Version-Release number of selected component (if applicable):
selinux-policy-3.14.1-29.el8+7.noarch
selinux-policy-devel-3.14.1-29.el8+7.noarch
selinux-policy-doc-3.14.1-29.el8+7.noarch
selinux-policy-minimum-3.14.1-29.el8+7.noarch
selinux-policy-mls-3.14.1-29.el8+7.noarch
selinux-policy-targeted-3.14.1-29.el8+7.noarch
setools-4.1.1-10.el8+7.x86_64
setools-console-4.1.1-10.el8+7.x86_64

How reproducible:
 * always

Steps to Reproduce:
1. get a RHEL-8.0 machine
2. install setools-console package
# sesearch -b virt_sandbox_use_nfs -A
<built-in function new_qpol_bool_t> returned a result with an error set
# echo $?
1
#

Expected results:
 * sesearch returns the same results as if the new boolean name was used
Comment 1 Milos Malik 2018-10-29 16:27:27 UTC 
Just checking if the bug is fixed in setools 4.2:

# rpm -qa setools\*
setools-console-4.2.0-0.3.rc.el8.x86_64
setools-4.2.0-0.3.rc.el8.x86_64
# grep virt_sandbox_use_nfs /etc/selinux/targeted/booleans.subs_dist 
virt_sandbox_use_nfs virt_use_nfs
# sesearch -b virt_sandbox_use_nfs -A
virt_sandbox_use_nfs is not a valid Boolean
# grep allow_ypbind /etc/selinux/targeted/booleans.subs_dist allow_ypbind nis_enabled
# sesearch -b allow_ypbind -A
allow_ypbind is not a valid Boolean
#

It isn't.
Comment 4 Vit Mojzis 2020-06-17 14:40:22 UTC 
https://github.com/SELinuxProject/setools/pull/48
Comment 13 errata-xmlrpc 2020-11-04 02:00:12 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (setools bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4544