Bug 2148390
| Summary: | /run/NetworkManager/no-stub-resolv.conf has SELinux context that restorecon is not happy about | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Jan Pazdziora <jpazdziora> |
| Component: | selinux-policy | Assignee: | Nikola Knazekova <nknazeko> |
| Status: | MODIFIED --- | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 9.0 | CC: | apeetham, bgalvani, lrintel, lvrabec, mmalik, rkhan, sfaye, sukulkar, thaller, till, zpytela |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-38.1.20-1.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | Bug | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Deadline: | 2023-08-08 | ||
|
Description
Jan Pazdziora
2022-11-25 10:23:01 UTC
with selinux-policy 38.1.9-1.el9_2:
$ ls -laZ /etc/resolv.conf /run/NetworkManager/{no-stub-,}resolv.conf
-rw-r--r--. 1 root root system_u:object_r:net_conf_t:s0 147 Mar 22 12:00 /etc/resolv.conf
-rw-r--r--. 1 root root system_u:object_r:NetworkManager_var_run_t:s0 147 Mar 22 12:00 /run/NetworkManager/no-stub-resolv.conf
-rw-r--r--. 1 root root system_u:object_r:net_conf_t:s0 147 Mar 22 12:00 /run/NetworkManager/resolv.conf
this is indeed wrong.
Note that NetworkManager will write those files by first creating a file "no-stub.resolv.conf.XXXXXX" (where XXXXXX are random characters) and do an atomic rename. I guess, the policy needs to account for that? That also applies to /etc/resolv.conf, /run/NetworkManager/resolv.conf and most files that NetworkManager writes (that is, not modifying the file in-place but doing the mktemp dance).
I think, "no-stub-resolv.conf" should be treated exactly the same as /run/NetworkManager/resolv.conf, which already seems to get the right labels.
Reassinging to selinux-policy.
Hi Thomas, is this somethi Hi, sorry for the incomplete message. Is there some new change in the NetworkManager? Our SELinux policy for Fedora and RHEL9.2 is the same. Also in the SELinux policy is not possible to handle random characters. Fedora 37 shows the same problem. Thanks to Thomas explanation, it became clear to me that the pattern for the no-stub-resolv.conf /var/run/NetworkManager/no-stub-resolv\.conf regular file system_u:object_r:net_conf_t:s0 needs to get the ".*" suffix like it is done here: /var/run/NetworkManager/resolv\.conf.* regular file system_u:object_r:net_conf_t:s0 @thaller can answer if anything changed in NM. My guess is that the no-stub-resolv.conf is rarely used and therefore next to no one will actually notice that the label is wrong. > @thaller can answer if anything changed in NM. I am not aware of any changes in this regard. What was said in comment 5 sounds right to me (thanks Till!). |