Bug 2148390

Summary: /run/NetworkManager/no-stub-resolv.conf has SELinux context that restorecon is not happy about
Product: Red Hat Enterprise Linux 9 Reporter: Jan Pazdziora <jpazdziora>
Component: selinux-policyAssignee: Nikola Knazekova <nknazeko>
Status: MODIFIED --- QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: medium    
Version: 9.0CC: apeetham, bgalvani, lrintel, lvrabec, mmalik, rkhan, sfaye, sukulkar, thaller, till, zpytela
Target Milestone: rcKeywords: Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: selinux-policy-38.1.20-1.el9 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2023-08-08   

Description Jan Pazdziora 2022-11-25 10:23:01 UTC
Description of problem:

On fresh RHEL 9.2 nightly installation, restorecon -vv /run/NetworkManager/no-stub-resolv.conf reports

Would relabel /run/NetworkManager/no-stub-resolv.conf from system_u:object_r:NetworkManager_var_run_t:s0 to system_u:object_r:net_conf_t:s0

The file content starts with

# Generated by NetworkManager

Presumably NetworkManager does not label the file properly to match the SELinux policy.

Version-Release number of selected component (if applicable):

NetworkManager-1.41.5-1.el9.x86_64
selinux-policy-38.1.1-1.el9.noarch

How reproducible:

Deterministic.

Steps to Reproduce:
1. Install RHEL.
2. restorecon -nvv /run/NetworkManager/no-stub-resolv.conf 

Actual results:

Would relabel /run/NetworkManager/no-stub-resolv.conf from system_u:object_r:NetworkManager_var_run_t:s0 to system_u:object_r:net_conf_t:s0

Expected results:

No such message, the context of the file already matches the SELinux policy.

Additional info:

This is a regression against RHEL 9.1 GA with

NetworkManager-1.40.0-1.el9.x86_64
selinux-policy-34.1.43-1.el9.noarch

The file context (system_u:object_r:NetworkManager_var_run_t:s0) is the same. So it's well possible that the SELinux policy has changed in RHEL 9.2, so either NetworkManager should reflect that, or that SELinux policy change needs to be reverted.

Comment 2 Thomas Haller 2023-03-22 16:09:17 UTC
with selinux-policy 38.1.9-1.el9_2:

$ ls -laZ /etc/resolv.conf /run/NetworkManager/{no-stub-,}resolv.conf
-rw-r--r--. 1 root root system_u:object_r:net_conf_t:s0               147 Mar 22 12:00 /etc/resolv.conf
-rw-r--r--. 1 root root system_u:object_r:NetworkManager_var_run_t:s0 147 Mar 22 12:00 /run/NetworkManager/no-stub-resolv.conf
-rw-r--r--. 1 root root system_u:object_r:net_conf_t:s0               147 Mar 22 12:00 /run/NetworkManager/resolv.conf

this is indeed wrong.


Note that NetworkManager will write those files by first creating a file "no-stub.resolv.conf.XXXXXX" (where XXXXXX are random characters) and do an atomic rename. I guess, the policy needs to account for that? That also applies to /etc/resolv.conf, /run/NetworkManager/resolv.conf and most files that NetworkManager writes (that is, not modifying the file in-place but doing the mktemp dance).


I think, "no-stub-resolv.conf" should be treated exactly the same as /run/NetworkManager/resolv.conf, which already seems to get the right labels.


Reassinging to selinux-policy.

Comment 3 Nikola Knazekova 2023-03-31 13:20:44 UTC
Hi Thomas, is this somethi

Comment 4 Nikola Knazekova 2023-04-03 12:56:14 UTC
Hi, sorry for the incomplete message. 

Is there some new change in the NetworkManager? Our SELinux policy for Fedora and RHEL9.2 is the same.
Also in the SELinux policy is not possible to handle random characters.

Comment 5 Till Maas 2023-04-03 13:51:52 UTC
Fedora 37 shows the same problem.

Thanks to Thomas explanation, it became clear to me that the pattern for the no-stub-resolv.conf 

/var/run/NetworkManager/no-stub-resolv\.conf       regular file       system_u:object_r:net_conf_t:s0 

needs to get the ".*" suffix like it is done here:

/var/run/NetworkManager/resolv\.conf.*             regular file       system_u:object_r:net_conf_t:s0 

@thaller can answer if anything changed in NM.
My guess is that the no-stub-resolv.conf is rarely used and therefore next to no one will actually notice that the label is wrong.

Comment 6 Thomas Haller 2023-04-03 13:56:32 UTC
> @thaller can answer if anything changed in NM.

I am not aware of any changes in this regard.

What was said in comment 5 sounds right to me (thanks Till!).

Comment 8 Nikola Knazekova 2023-08-01 19:54:10 UTC
PR: https://github.com/fedora-selinux/selinux-policy/pull/1810