Bug 2174329

+++ This bug was initially created as a clone of Bug #2012772 +++

Description of problem:

Browsing the context database, I could find some unexpected patterns, which may confuse customers trying to add their own paths.

Example with "-":
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
/home/\-inst                                       directory          system_u:object_r:home_root_t:s0 
/usr/lib/NetworkManager/nm\-.*                     regular file       system_u:object_r:bin_t:s0 
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

These 3 patterns have a leading backslash prior to the dash, is that really needed? I don't think so.

Examples with "." (more an issue since "." means "any character)
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
[...]
/etc/cron.daily(/.*)?                              all files          system_u:object_r:bin_t:s0 
/etc/cron.hourly(/.*)?                             all files          system_u:object_r:bin_t:s0 
/etc/cron.minutely/openshift-facts                 regular file       system_u:object_r:openshift_cron_exec_t:s0 
/etc/cron.monthly(/.*)?                            all files          system_u:object_r:bin_t:s0 
/etc/cron.weekly(/.*)?                             all files          system_u:object_r:bin_t:s0 
[...]
/var/run/sssd.pid                                  regular file       system_u:object_r:sssd_var_run_t:s0 
/var/run/svnserve.pid                              regular file       system_u:object_r:svnserve_var_run_t:s0 
/var/run/syslog-ng.ctl                             regular file       system_u:object_r:syslogd_var_run_t:s0 
[...]
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

All the above patterns are wrong, the dot should be escaped (e.g. /etc/cron\.daily/...).
The following command shows most of the issues with "dot":

-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# semanage fcontext -l | grep "[^\\/]\.[^\*\+]"
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Please fix the policy accordingly, we need to have something sane to not confuse customers.

Version-Release number of selected component (if applicable):

selinux-policy-3.14.3-67.el8_4.2.noarch

How reproducible:

N/A

--- Additional comment from Zdenek Pytela on 2022-06-14 20:03:27 CEST ---

This issue will be considered for the next RHEL minor version inclusion. What needs to be taken into account is that we are now in the middle of development cycle and we should try to avoid any kind of regression.