Bug 2081059

Summary:	[RFE] semanage default file contexts in /opt/
Product:	Red Hat Enterprise Linux 9	Reporter:	cweather
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	9.0	CC:	lvrabec, mmalik, ssekidde
Target Milestone:	rc	Keywords:	FutureFeature, Triaged
Target Release:	9.1	Flags:	pm-rhel: mirror+
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-34.1.32-1.el9	Doc Type:	Bug Fix
Doc Text:	Cause: In the file context database only entries for a few directories in /opt exist. Consequence: Some 3rd party software needs additional adjustments to selinux-policy file context database. Fix: Patterns for /etc and /var subtrees inside the /opt tree were added to make it consistent with the / tree. Result: 3rd party software installed to /opt works without	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-11-15 11:13:50 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 5 Zdenek Pytela 2022-05-11 17:28:29 UTC

The patterns were added to the policy as requested and will be a part of the next centos stream build.

However, note that FHS 3.0 [1] mentions:

Programs to be invoked by users must be located in the directory /opt/<package>/bin or under the /opt/<provider> hierarchy.

In SELinux, file context equivalency can be used to achieve even more flexible settings, e. g.

  # semanage fcontext -a -e / "/opt/<provider><package>"

provided the package tree follows usual directory structure, in which case no additional rules for e. g. /opt/(.*/)?etc(/.*)? are needed.

[1] https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch03s13.html

Comment 16 errata-xmlrpc 2022-11-15 11:13:50 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:8283