Bug 2135794

Summary: Listening socket has incorrect label when SELinuxContextFromNet=yes is set
Product: Red Hat Enterprise Linux 9 Reporter: Michal Sekletar <msekleta>
Component: systemdAssignee: Michal Sekletar <msekleta>
Status: CLOSED ERRATA QA Contact: Frantisek Sumsal <fsumsal>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 9.0CC: dtardon, jamacku, systemd-maint-list, txtoth, zpytela
Target Milestone: rcKeywords: Improvement, Reproducer, TestOnly, Triaged
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: systemd-252-3.el9 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 2136738 (view as bug list) Environment:
Last Closed: 2023-05-09 08:21:58 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2138081    
Bug Blocks: 2136738    
Attachments:
Description Flags
Patch for the test case Sanity/SELinuxContextFromNet none

Description Michal Sekletar 2022-10-18 12:55:38 UTC 
Created attachment 1918740 [details]
Patch for the test case Sanity/SELinuxContextFromNet

Description of problem:
When we start to listen on socket that has SELinuxContextFromNet=yes we compute SELinux label of the socket using systemd's own label instead of label of target executable that is launched by the triggered service.

Version-Release number of selected component (if applicable):
systemd-250-12.el9_1.x86_64

How reproducible:
Deterministic

Steps to Reproduce:
Patch for test case Sanity/SELinuxContextFromNet which exhibits the issue is attached.

Actual results:
Patched test case fails.


Expected results:
Patched test case passes.


Additional info:
https://github.com/systemd/systemd/pull/24994
Comment 1 David Tardon 2022-10-19 07:22:03 UTC 
*** Bug 2135941 has been marked as a duplicate of this bug. ***
Comment 2 Ted X Toth 2022-10-19 12:57:41 UTC 
Can this be backported to RHEL 8?
Comment 3 Michal Sekletar 2022-10-21 06:21:26 UTC 
(In reply to Ted X Toth from comment #2)
> Can this be backported to RHEL 8?

I've cloned the BZ also against RHEL-8.
Comment 7 errata-xmlrpc 2023-05-09 08:21:58 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (systemd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2531