Bug 1801846

+++ This bug was initially created as a clone of Bug #1690527 +++

Description of problem:

useradd does not "create_mail()" (create /var/spool/mail/$USER) with a proper context currently

create_home() calls set_selinux_file_context() and reset_selinux_file_context()
when user home is created to ensure that user home is labeled properly.

https://github.com/shadow-maint/shadow/blob/master/src/useradd.c#L2042

create_mail() however does not, and so user mail spool files end up mislabeled.

https://github.com/shadow-maint/shadow/blob/master/src/useradd.c#L2131

Version-Release number of selected component (if applicable):

shadow-utils-4.6-9.fc31.x86_64

How reproducible:
useradd -Z user_u joe

Steps to Reproduce:
1. useradd -Z user_u joe
2. ls -alZ /var/spool/mail/joe
3. note now the selinux user identity in the context of /var/spool/mail/joe is not user_u 

Actual results:
the selinux user identity of /var/spool/mail/joe is not "user_u"

Expected results:
the selinux user identity of /var/spool/mail/joe is "user_u"

Additional info:
Access control can be enforced based on selinux user identities, roles and security levels (just as on types). It is important that the labels are acurate

--- Additional comment from  on 2019-03-19 17:25:51 CET ---

Err, well the reproducer is not acurate ...

You would need to leverage it properly first, like so:

echo '(filecon "/var/spool/mail/%{USERNAME}" file (system_u object_r mail_spool_t ((s0)(s0))))' > mytest.cil && sudo semodule -i mytest.cil
useradd -Z user_u joe
matchpathcon /var/spool/mail/joe
ls -alZ /var/spool/mail/joe

--- Additional comment from Ben Cotton on 2019-08-13 19:06:31 CEST ---

This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to '31'.

--- Additional comment from Ben Cotton on 2019-08-13 21:31:00 CEST ---

This bug appears to have been reported against 'rawhide' during the Fedora 31 development cycle.
Changing version to 31.

--- Additional comment from  on 2020-02-06 15:37:35 CET ---

I have a fix for this issue. Would you be willing to test a scratch build?

--- Additional comment from  on 2020-02-06 17:59:40 CET ---

heck yes! Can I have URL to scratch built?

--- Additional comment from  on 2020-02-10 13:11:20 CET ---

I am patiently awaiting the URL of the scratch built so that i can test to see whether the patch address the requested functionality

--- Additional comment from  on 2020-02-10 13:26:02 CET ---

Sorry, when I was on the point of generating the scratch build I got some comments on the pull-request that I created to fix this bug. I'm still trying to figure out how to make the improvements from the comment and keep the fix working as it should. I will come back to you as soon as everything is ready.

--- Additional comment from Petr Lautrbach on 2020-02-11 14:53:19 CET ---

The patch from PR looks good, however it would also need to update selinux-policy in order to provide a template file context for /var/spool/mail/USER

--- Additional comment from Petr Lautrbach on 2020-02-11 18:36:25 CET ---

I'd expect something like:

--- a/mta.fc
+++ b/mta.fc
@@ -41,4 +41,5 @@ ifdef(`distro_redhat',`
 /var/spool/(client)?mqueue(/.*)?       gen_context(system_u:object_r:mqueue_spool_t,s0)
 /var/spool/mqueue\.in(/.*)?    gen_context(system_u:object_r:mqueue_spool_t,s0)
 /var/spool/mail(/.*)?          gen_context(system_u:object_r:mail_spool_t,s0)
+/var/spool/mail/USER           --      gen_context(system_u:object_r:mail_spool_t,s0)
 /var/spool/smtpd(/.*)?         gen_context(system_u:object_r:mail_spool_t,s0)

--- Additional comment from Petr Lautrbach on 2020-02-11 18:58:57 CET ---

https://koji.fedoraproject.org/koji/taskinfo?taskID=41459946

before

$ matchpathcon /var/spool/mail/user
/var/spool/mail/user    system_u:object_r:mail_spool_t:s0

after

$ matchpathcon /var/spool/mail/user
/var/spool/mail/user    user_u:object_r:mail_spool_t:s0