Bug 2187893

Summary:	Incorrect default SELinux labels
Product:	Red Hat Enterprise Linux 9	Reporter:	Marko Myllynen <myllynen>
Component:	selinux-policy	Assignee:	Nobody <nobody>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	9.2	CC:	lvrabec, mmalik, spotrh, than, tpopela, yaneti, zpytela
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-38.1.20-1.el9	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:
Clones:	2221573 (view as bug list)		Environment:
Last Closed:	2023-11-07 08:52:21 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2023-05-30

Description Marko Myllynen 2023-04-19 05:20:54 UTC

Description of problem:
With firefox when starting the browser for the first time the configuration directory is created with correct SELinux labels:

$ rm -rf ~/.mozilla
$ firefox
$ restorecon -Rv ~/.mozilla
$

But with chromium the files get relabeled:

$ rm -rf ~/.cache/chromium ~/.config/chromium
$ chromium-browser
[7517:7517:0419/080842.293745:ERROR:chrome_browser_cloud_management_controller.cc(162)] Cloud management controller initialization aborted as CBCM is not enabled.
MESA-INTEL: warning: Performance support disabled, consider sysctl dev.i915.perf_stream_paranoid=0
[7555:7555:0419/080842.322254:ERROR:gpu_init.cc(525)] Passthrough is not supported, GL is egl, ANGLE is 
$ restorecon -Rv ~/.cache/chromium ~/.config/chromium | wc -l
283

It looks like chromium and selinux-policy are not fully in sync on which labels should be used. Thanks.

Version-Release number of selected component (if applicable):
chromium-112.0.5615.121-2.el9.x86_64
selinux-policy-targeted-34.1.43-1.el9_1.2.noarch

Comment 1 Zdenek Pytela 2023-05-11 17:25:28 UTC

I've submitted a PR to address the issue in Fedora:
https://github.com/fedora-selinux/selinux-policy/pull/1679

It will be a part of the next F38 and rawhide builds.

Comment 20 Milos Malik 2023-07-10 07:39:43 UTC

The same issue is reproducible on RHEL-8.9 and was filed as BZ#2221573.

Comment 24 Nikola Knazekova 2023-08-01 13:09:10 UTC

https://github.com/fedora-selinux/selinux-policy/pull/1785/files

Comment 37 errata-xmlrpc 2023-11-07 08:52:21 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6617