Bug 1879749

Summary: /usr/share/restraint/plugins/task_run.d/20_unconfined has incorrect SELinux label
Product: [Retired] Restraint Reporter: Jan Stodola <jstodola>
Component: generalAssignee: beaker-dev-list
Status: CLOSED DEFERRED QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: asavkov, bpeck, breilly, cbeer, cbouchar
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-05-11 19:38:38 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Stodola 2020-09-16 21:24:02 UTC 
Description of problem:
When restraint is installed in a %post kickstart section, SELinux label of /usr/share/restraint/plugins/task_run.d/20_unconfined is not correct:

# restorecon -nv /usr/share/restraint/plugins/task_run.d/20_unconfined
Would relabel /usr/share/restraint/plugins/task_run.d/20_unconfined from system_u:object_r:usr_t:s0 to system_u:object_r:unconfined_exec_t:s0
#

The same problem after uninstalling restraint (and it's dependencies) and installing it again:

# yum erase restraint
..
Dependencies resolved.
===============================================================================
 Package                                          Architecture   Version 
===============================================================================
Removing:
 restraint                                        x86_64         0.3.1-1.el8bkr   
Removing dependent packages:
 beaker-core-tasks-distribution-check-install     noarch         1.0-3
 beaker-distribution-reservesys                   noarch         3.4-12
Removing unused dependencies:
 make                                             x86_64         1:4.2.1-10.el8
 restraint-rhts                                   x86_64         0.3.1-1.el8bkr
...

# yum install restraint
...
=================================================================================
 Package                                         Architecture    Version         
=================================================================================
Installing:
 restraint                                       x86_64          0.3.1-1.el8bkr  
Transaction Summary
=================================================================================
..

# restorecon -nv /usr/share/restraint/plugins/task_run.d/20_unconfined
Would relabel /usr/share/restraint/plugins/task_run.d/20_unconfined from system_u:object_r:usr_t:s0 to system_u:object_r:unconfined_exec_t:s0
#

Version-Release number of selected component (if applicable):
restraint-0.3.1-1.el8bkr

How reproducible:
Always

Steps to Reproduce:
1. restorecon -nv /usr/share/restraint/plugins/task_run.d/20_unconfined

Actual results:
Would relabel /usr/share/restraint/plugins/task_run.d/20_unconfined from system_u:object_r:usr_t:s0 to system_u:object_r:unconfined_exec_t:s0


Expected results:
Nothing to relabel
Comment 1 Carol Bouchard 2021-05-11 19:38:38 UTC 
This Bugzilla ticket is being closed in order to retire the restraint product from Bugzilla. The Jira ticket referenced above will be reopened.