Bug 2162313
| Summary: | fixfiles does not take linked and bind mounted volumes into account | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Jiří Mencák <jmencak> |
| Component: | policycoreutils | Assignee: | Vit Mojzis <vmojzis> |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.6 | CC: | dwalsh, lvrabec, mmalik, plautrba, rhodain, ssekidde, vmojzis |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-03-02 10:19:22 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Jiří Mencák
2023-01-19 10:44:15 UTC
Would `fixfiles -M ...` help? -M Bind mount filesystems before relabeling them, this allows fixing the context of files or directories that have been mounted over. Thank you for looking Petr, (In reply to Petr Lautrbach from comment #1) > Would `fixfiles -M ...` help? > > -M Bind mount filesystems before relabeling them, this allows fixing > the context of files or directories that have been mounted over. The short answer is NO. Longer answer: - the -M option doesn't ship with fixfiles in RHEL8.6 - looking at the (Fedora) manual page (and what you pasted) and the code suggests that it does the complete opposite of what I want it to do - inspite of all the above, I still tried your suggestion and it failed as expected A note to QE.
One way of testing a fix is to build your own container-selinux-2.173.2-1 RPM package and remove
%selinux_relabel_post -s %{selinuxtype}
by
# diff -Nura *.orig *.spec
--- container-selinux.spec.orig 2023-01-10 08:07:20.000000000 -0500
+++ container-selinux.spec 2023-01-10 10:02:44.000000000 -0500
@@ -98,7 +98,6 @@
fi
%posttrans
-%selinux_relabel_post -s %{selinuxtype}
#define license tag if not already defined
%{!?_licensedir:%global license %doc}
This will not cause the invocation of
/usr/sbin/fixfiles -C /var/lib/rpm-state/file_contexts.pre restore
during the upgrade of the container-selinux package.
Then you can run the fixfiles manually and see if the SELinux labels have changed.
I don't think `fixfiles` should decide on its own whether a bind or any other mount should be relabeled or not.
`fixfiles` could be configured to exclude particular directories from relabeling, see `man fixfiles`:
The file /etc/selinux/fixfiles_exclude_dirs can contain a list of directories excluded from relabeling.
# mount --rbind /etc/sysconfig/ /var/lib/kubelet/bind-sysconfig
# fixfiles -v restore /etc /var
Relabeled /var/lib/kubelet/bind-sysconfig from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/nftables.conf from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/selinux from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/raid-check from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/firewalld from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/network-scripts from system_u:object_r:net_conf_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/network-scripts/readme-ifcfg-rh.txt from system_u:object_r:net_conf_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/sshd from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/chronyd from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/man-db from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/kernel from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/anaconda from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/network from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
Relabeled /var/lib/kubelet/bind-sysconfig/grub from system_u:object_r:etc_t:s0 to system_u:object_r:var_lib_t:s0
# umount /var/lib/kubelet/bind-sysconfig/
# fixfiles -v restore /etc /var
Relabeled /etc/sysconfig from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/nftables.conf from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/selinux from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/raid-check from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/firewalld from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/network-scripts from system_u:object_r:var_lib_t:s0 to system_u:object_r:net_conf_t:s0
Relabeled /etc/sysconfig/network-scripts/readme-ifcfg-rh.txt from system_u:object_r:var_lib_t:s0 to system_u:object_r:net_conf_t:s0
Relabeled /etc/sysconfig/sshd from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/chronyd from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/man-db from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/kernel from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/anaconda from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/network from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
Relabeled /etc/sysconfig/grub from system_u:object_r:var_lib_t:s0 to system_u:object_r:etc_t:s0
# echo /var/lib/kubelet/bind-sysconfig > /etc/selinux/fixfiles_exclude_dirs
# mount --rbind /etc/sysconfig/ /var/lib/kubelet/bind-sysconfig
# fixfiles -v restore /etc /var
skipping the directory /var/lib/kubelet/bind-sysconfig
skipping the directory /var/lib/kubelet/bind-sysconfig
If there's non-standard mount configuration it should be also projected to /etc/selinux/fixfiles_exclude_dirs to avoid unwanted relabeling.
|