Bug 1926511

Summary:	restorecon ENOENT policy error is unclear
Product:	Red Hat Enterprise Linux 8	Reporter:	Ken Dreyer (Red Hat) <kdreyer>
Component:	policycoreutils	Assignee:	Vit Mojzis <vmojzis>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.5	CC:	dwalsh, lvrabec, mmalik, plautrba, ssekidde, vmojzis
Target Milestone:	rc	Keywords:	AutoVerified, Triaged
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	policycoreutils-2.9-18.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:
Clones:	2041975 (view as bug list)		Environment:
Last Closed:	2022-05-10 15:25:47 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ken Dreyer (Red Hat) 2021-02-08 22:10:20 UTC

Description of problem:
When I do not have selinux-policy-targeted installed and I still have "SELINUXTYPE=targeted" configured in /etc/selinux/config, restorecon will return hard-to-understand ENOENT error messages.

Version-Release number of selected component (if applicable):
policycoreutils-2.9-10.el8.x86_64

How reproducible:
always

Steps to Reproduce:
1. Uninstall selinux-policy-targeted and install selinux-policy-minimum
2. Ensure /etc/selinux/config has "SELINUXTYPE=targeted" (the WRONG policy)
3. touch /tmp/foo.txt
4. restorecon -v /tmp/foo.txt

Actual results:
restorecon fails with a mysterious error message "No such file or directory". Users are confused because /tmp/foo.txt does exist.

Expected results:
restorecon shows the user the exact path that corresponds to the fatal ENOENT error message. It's not /tmp/foo.txt, but it's something under /etc/selinux/targeted/.

Additional info:
We ran into this UX problem while troubleshooting https://bugzilla.redhat.com/show_bug.cgi?id=1923719

Comment 1 Petr Lautrbach 2021-03-03 12:42:53 UTC

ENOENT is propagated from selabel_subs_init():


#0  selabel_subs_init (path=0x55555555bc60 "/etc/selinux/targeteda/contexts/files/file_contexts.subs_dist", digest=digest@entry=0x0, 
    out_subs=out_subs@entry=0x55555555b378) at /usr/src/debug/libselinux-3.2-0.rc2.1.fc34.x86_64/src/label_file.c:612
#1  0x00007ffff7fa2924 in init (rec=0x55555555b2e0, opts=<optimized out>, n=<optimized out>)
    at /usr/src/debug/libselinux-3.2-0.rc2.1.fc34.x86_64/src/selinux_config.c:254
#2  0x00007ffff7fa252b in selabel_open (backend=0, opts=0x7fffffffe3d0, nopts=3) at /usr/src/debug/libselinux-3.2-0.rc2.1.fc34.x86_64/src/label.c:228
#3  0x0000555555556ac2 in restore_init (opts=0x55555555a0c0 <r_opts>)
    at /usr/src/debug/policycoreutils-3.2-0.rc2.1.fc34.x86_64/policycoreutils/setfiles/restore.c:30
#4  main (argc=3, argv=0x7fffffffe5c8) at /usr/src/debug/policycoreutils-3.2-0.rc2.1.fc34.x86_64/policycoreutils/setfiles/setfiles.c:428

But the error message is printed in restore_init():

	opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
	if (!opts->hnd) {
		perror(opts->selabel_opt_path);
		exit(1);
	}

Comment 17 errata-xmlrpc 2022-05-10 15:25:47 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (policycoreutils bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2068