Bug 1871784

Summary:	Creating a user mapped explicitly with home directory in /tmp breaks the system
Product:	Red Hat Enterprise Linux 7	Reporter:	Renaud Métrich <rmetrich>
Component:	libsemanage	Assignee:	Vit Mojzis <vmojzis>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.8	CC:	dwalsh, lvrabec, mmalik, plautrba, ssekidde
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-24 10:56:13 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Renaud Métrich 2020-08-24 10:10:47 UTC

Description of problem:

Creating a user mapped explicitly with home directory being /tmp breaks the context of /tmp:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# useradd -Z unconfined_u -d /tmp test

# matchpathcon /tmp
/tmp	unconfined_u:object_r:user_home_dir_t:s0
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

This happens even though the default "usepasswd=False" is used in /etc/selinux/semanage.conf:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# usepasswd check tells semanage to scan all pass word records for home directories
# and setup the labeling correctly.  If this is turned off, SELinux will label /home 
# correctly only.  You will need to use semanage fcontext command.  
# For example, if you had home dirs in /althome directory you would have to execute
# semanage fcontext -a -e /home /althome
usepasswd=False
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

With "usepasswd=False", from the comment in the file, the tools are not supposed to change anything that is outside "/home".


Version-Release number of selected component (if applicable):

libsemanage-2.5-14.el7.x86_64


How reproducible:

Always, see above.

Additional info:

This issue is critical when updating Red Hat software such as RHVH: internally RHVH update procedure uses temporary mounts in /tmp/XXX that get all their files relabeled with "user_home_dir_t" due to this bug.

A workaround is to amend "ignoredirs" to specify "/tmp" as well:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
ignoredirs=/root;/tmp
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Comment 2 Lukas Vrabec 2020-08-24 10:56:13 UTC

This issue was not selected to be included in Red Hat Enterprise Linux 7 because it is seen either as low or moderate impact to a small number of use-cases. Current minor release will be in Maintenance Support 2 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available.

We will now close this issue, but if you believe that it qualifies for the Maintenance Support 2 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable.