Bug 2069588

Summary:	Mode differs for /var/lib/sepolgen/interface_info
Product:	[Fedora] Fedora	Reporter:	Łukasz Filipek <lukasz.filipek>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	35	CC:	dwalsh, grepl.miroslav, lvrabec, mmalik, omosnace, pkoncity, plautrba, vmojzis, zpytela
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-09-06 15:08:33 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Łukasz Filipek 2022-03-29 08:23:00 UTC

Description of problem:

After installing selinux-policy-devel-35.15-1.fc35.noarch and then run rpm --verify i get mode differs problem:

  $ rpm -V selinux-policy-devel-35.15-1.fc35.noarch
  .M.......  g /var/lib/sepolgen/interface_info

  $ ls -l /var/lib/sepolgen/interface_info
  -rw-r--r--. 1 root root 3108419 Mar 29 09:51 /var/lib/sepolgen/interface_info

I can restore package permissions using the rpm --setperms command:

  $ rpm --setperms selinux-policy-devel-35.15-1.fc35.noarch

And the result is:

  $ ls -l /var/lib/sepolgen/interface_info
  ----------. 1 root root 3108419 Mar 29 09:51 /var/lib/sepolgen/interface_info

It is unclear what permissions are appropriate. 

Steps to Reproduce:
1. Install selinux-policy-devel-35.15-1.fc35.noarch
2. Run package verification: rpm -V selinux-policy-devel-35.15-1.fc35.noarch
3. Mode differs
4. Restore perms: rpm --setperms selinux-policy-devel-35.15-1.fc35.noarch
5. Perform step number 2 again.

Actual results:
Wrong permissions?

Expected results:
Proper permissions after installing the package.

Comment 1 Zdenek Pytela 2022-03-29 18:35:15 UTC

Vito,

It seems to me the /var/lib/sepolgen/interface_info file is created on selinux-policy-devel installation:

  154 %post devel
  155 %{_sbindir}/selinuxenabled && %{_bindir}/sepolgen-ifgen 2>/dev/null
  156 exit 0

The file is listed as a ghost file:
  152 %ghost %{_sharedstatedir}/sepolgen/interface_info

Does sepolgen-ifgen use some equivalent of "umask 777" when the file is created for the first time?

Once the permissions are fixed, next run of the command does not change the permissions.

Speaking of interface_info, why at all is this file a ghost file?

Comment 2 Vit Mojzis 2022-03-30 12:46:37 UTC

(In reply to Zdenek Pytela from comment #1)
> Vito,
> 
> It seems to me the /var/lib/sepolgen/interface_info file is created on
> selinux-policy-devel installation:
> 
>   154 %post devel
>   155 %{_sbindir}/selinuxenabled && %{_bindir}/sepolgen-ifgen 2>/dev/null
>   156 exit 0
> 
> The file is listed as a ghost file:
>   152 %ghost %{_sharedstatedir}/sepolgen/interface_info
> 
> Does sepolgen-ifgen use some equivalent of "umask 777" when the file is
> created for the first time?

Yes, but the value (644) is "hardcoded" in policycoreutils. 
I believe we should either specify the value in the spec file (i.e. %attr(644,root,root)), or better yet disable validation on the file (%verify(not md5 size mode mtime)).

%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/sepolgen/interface_info


> 
> Once the permissions are fixed, next run of the command does not change the
> permissions.
> 
> Speaking of interface_info, why at all is this file a ghost file?

Because it is not shipped by the package (hence rpmbuild would complain about the file missing if we used a normal definition), but it is used for policy compilation, so we still want to tie it to selinux-policy-devel package after it is generated.

Comment 3 Vit Mojzis 2022-03-30 12:52:25 UTC

https://src.fedoraproject.org/rpms/selinux-policy/pull-request/269

Comment 4 Petr Lautrbach 2022-09-06 15:08:33 UTC

Merged 3 months ago. Closing.

https://src.fedoraproject.org/rpms/selinux-policy/c/193d303b3b4915c23798368b516b59b2bd49f0b5?branch=rawhide