Bug 2231023
| Summary: | setroubleshoot dies when an incompatible selinux python module exists in /usr/local/lib | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Renaud Métrich <rmetrich> |
| Component: | setroubleshoot | Assignee: | Vit Mojzis <vmojzis> |
| Status: | CLOSED MIGRATED | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.8 | CC: | jgalipea, lvrabec, mmalik, plautrba, vmojzis |
| Target Milestone: | rc | Keywords: | MigratedToJIRA, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-09-19 20:21:07 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug. |
Description of problem: All platform-python scripts should be protected from using custom paths such as /usr/local/lib/python3.6, or else failure may happen when 3rd party python modules are present in such directory. We have a customer hitting this issue due to having his own /usr/local/lib/python3.6/site-packages/selinux module taking precedence other our module (/usr/lib64/python3.6/site-packages/selinux). In order to avoid the issue, /usr/share/setroubleshoot/SetroubleshootPrivileged.py shebang has to be modified as shown below: -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- #!/usr/libexec/platform-python -Es -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Version-Release number of selected component (if applicable): setroubleshoot-server-3.3.26-5.el8.x86_64 How reproducible: Always Steps to Reproduce: 1. Create a rogue selinux module -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # mkdir -p /usr/local/lib/python3.6/site-packages/selinux # echo "BUG" > /usr/local/lib/python3.6/site-packages/selinux/__init__.py -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- 2. Trigger an AVC or use the following python inline script to illustrate what would happen -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # /usr/libexec/platform-python [...] >>> import selinux Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/local/lib/python3.6/site-packages/selinux/__init__.py", line 1, in <module> BUG NameError: name 'BUG' is not defined -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- Actual results: Faulty /usr/local/lib/python3.6/site-packages/selinux loaded instead of /usr/lib64/python3.6/site-packages/selinux Expected results: /usr/lib64/python3.6/site-packages/selinux being loaded, as seen with "/usr/libexec/platform-python -Es": -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< -------- # /usr/libexec/platform-python -Es [...] >>> import selinux >>> -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------