Bug 1731501

Summary: [RFE] add possibility to check sum of loaded module
Product: Red Hat Enterprise Linux 8 Reporter: Filip Krska <fkrska>
Component: policycoreutilsAssignee: Petr Lautrbach <plautrba>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact: Jan Fiala <jafiala>
Priority: medium    
Version: 8.4CC: batkisso, dwalsh, jafiala, lagordon, lvrabec, mjahoda, mmalik, plautrba, ssekidde, tscherf, vmojzis
Target Milestone: rcKeywords: FutureFeature, Triaged
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: policycoreutils-2.9-17.el8 Doc Type: Enhancement
Doc Text:
.New option to verify SELinux module checksums With the newly added `--checksum` option to the `semodule` command, you can verify the versions of installed SELinux policy modules. Because Common Intermediate Language (CIL) does not store module name and module version in the module itself, there previously was no simple way to verify that the installed module is the same version as the module which was supposed to be installed. With the new command `semodule -l --checksum`, you receive a SHA256 hash of the specified module and can compare it with the checksum of the original file, which is faster than reinstalling modules. Example of use: ---- # semodule -l --checksum | grep localmodule localmodule sha256:db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd # /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd - ----
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-05-10 15:25:47 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Filip Krska 2019-07-19 14:41:05 UTC
Description of problem:

1. Proposed title of this feature request

[RFE] add possibility to check sum of loaded module

2. Who is the customer behind the request?

Account: RED HAT IT/IS 5243891
TAM customer: yes
CSM customer: yes
Strategic: yes

3. What is the nature and description of the request?

Use case:

Ansible loads a module. If I then need to make changes to 
this policy in the future, how can Ansible compare the .pp file in 
config management with the state loaded on the system?

Need some mechanism to compare loaded module with definition of the module we expect to be running.

4. Why does the customer need this? (List the business requirements here)

Having Ansible reload the module every run will cause problems in real operations.

5. How would the customer like to achieve this? (List the functional requirements here)

Introduce st like `semodule -l --checksum` that could be compared with the module definition.

6. For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.

7. Is there already an existing RFE upstream or in Red Hat Bugzilla?

No

8. Does the customer have any specific timeline dependencies and which release would they like to target (i.e. RHEL5, RHEL6)?

9. Is the sales team involved in this request and do they have any additional input?

10. List any affected packages or components.

11. Would the customer be able to assist in testing this functionality if implemented?

Yes

Comment 32 errata-xmlrpc 2022-05-10 15:25:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (policycoreutils bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2068