Bug 1967642

Summary:	compilation of container_runtime_run interface leads to errors
Product:	Red Hat Enterprise Linux 8	Reporter:	Milos Malik <mmalik>
Component:	container-selinux	Assignee:	Jindrich Novy <jnovy>
Status:	CLOSED ERRATA	QA Contact:	atomic-bugs <atomic-bugs>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	8.5	CC:	jnovy, lvrabec, mmalik, plautrba, ssekidde, tsweeney, weshen, ypu
Target Milestone:	beta	Keywords:	Triaged
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	container-selinux-2.173.1-1.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-10 13:27:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Milos Malik 2021-06-03 14:15:38 UTC

Description of problem:
 * all interfaces can be compiled using the sepolicy tool except for this one

Version-Release number of selected component (if applicable):
policycoreutils-2.9-14.el8.x86_64
policycoreutils-dbus-2.9-14.el8.noarch
policycoreutils-devel-2.9-14.el8.x86_64
policycoreutils-gui-2.9-14.el8.noarch
policycoreutils-newrole-2.9-14.el8.x86_64
policycoreutils-python-utils-2.9-14.el8.noarch
policycoreutils-restorecond-2.9-14.el8.x86_64
policycoreutils-sandbox-2.9-14.el8.x86_64
selinux-policy-3.14.3-69.el8.noarch
selinux-policy-devel-3.14.3-69.el8.noarch
selinux-policy-doc-3.14.3-69.el8.noarch
selinux-policy-minimum-3.14.3-69.el8.noarch
selinux-policy-mls-3.14.3-69.el8.noarch
selinux-policy-sandbox-3.14.3-69.el8.noarch
selinux-policy-targeted-3.14.3-69.el8.noarch

How reproducible:
 * always

Actual results:
# sepolicy interface -c -i container_runtime_run
Compiling container_runtime_run interface
Compiling targeted compiletest module
compiletest.te:43:ERROR 'unknown class dbus' at token ';' on line 4492:
	allow sepolicy_domain_t container_runtime_t:dbus send_msg;
#line 43
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [/usr/share/selinux/devel/include/Makefile:157: tmp/compiletest.mod] Error 1
Compile test for container_runtime_run failed.


Expected results:
 * no errors

Comment 2 Milos Malik 2021-06-03 14:26:49 UTC

I forgot to mention that errors appear when the container-selinux package is NOT installed.
Once the container-selinux package is installed, compilation of this interface does NOT produce any errors.

Comment 3 Milos Malik 2021-06-03 14:40:40 UTC

Tested with container-selinux-2:2.124.0-1.gitf958d0c.module+el8.3.0+10171+12421f43.noarch package.

Comment 4 Zdenek Pytela 2022-01-14 17:22:28 UTC

Switching the component, needs to be resolved in container.if, e. g. this way:
https://github.com/containers/container-selinux/pull/163

Comment 6 Tom Sweeney 2022-01-18 16:41:39 UTC

Setting to Post and assigning to @jnovy for any packaging and BZ needs.

Fixed in this release of container-selinux: https://github.com/containers/container-selinux/releases/tag/v2.173.1

Comment 12 errata-xmlrpc 2022-05-10 13:27:31 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: container-tools:rhel8 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:1762