Bug 2236729

Summary:	Installing gcc-toolset-12-binutils results in files with incorrect selinux context.
Product:	Red Hat Enterprise Linux 9	Reporter:	Nick Clifton <nickc>
Component:	gcc-toolset-13-binutils	Assignee:	Nick Clifton <nickc>
Status:	CLOSED ERRATA	QA Contact:	Miloš Prchlík <mprchlik>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	9.3	CC:	fweimer, mcermak, mprchlik, peter.vreman, sgardner
Target Milestone:	rc	Keywords:	Bugfix, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	gcc-toolset-13-binutils-2.40-15.el9	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:	2232410	Environment:
Last Closed:	2024-04-30 09:40:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2232410
Bug Blocks:

Description Nick Clifton 2023-09-01 11:53:33 UTC

+++ This bug was initially created as a clone of Bug #2232410 +++

Description of problem:
When installing the gcc-toolset-11-binutils.  Files within directory "/opt/rh/gcc-toolset-12/root/usr/share/locale/" are created with incorrect context.

The files are expected to get context from gcc-toolset-12-runtime package which has an install script that creates the following selinux rule.
---------------------------------------------------------------------------------
if [ ! -f /opt/rh/gcc-toolset-12/root/etc/selinux-equiv.created ]; then
  /usr/sbin/semanage fcontext -a -e / /opt/rh/gcc-toolset-12/root
  restorecon -R /opt/rh/gcc-toolset-12/root
  touch /opt/rh/gcc-toolset-12/root/etc/selinux-equiv.created
fi
---------------------------------------------------------------------------------

I believe this fails because the context rule is created just before installing these files, and the rule has yet to be written to disk.  This can be avoided by simply installing gcc-toolset-12-runtime first, and then installing gcc-toolset-12-binutils in a separate command.

This is only reproduced when both packages are installed in the same yum command.




Version-Release number of selected component (if applicable):
gcc-toolset-12-binutils-2.38-16.el8.x86_64

NOTE- This is also reproduced on all available version in RHEL8.




How reproducible:
Easily


Steps to Reproduce:
1.# yum remove gcc-toolset-12-runtime
1.# yum install gcc-toolset-12-binutils
2.# restorecon -Rvn /opt/rh/gcc-toolset-12/root/


Actual results:
]# restorecon -Rvn /opt/rh/gcc-toolset-12
Would relabel /opt/rh/gcc-toolset-12/root/usr/lib64/bfd-plugins from system_u:object_r:usr_t:s0 to system_u:object_r:lib_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/bg from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/bg/LC_MESSAGES from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/bg/LC_MESSAGES/binutils.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/bg/LC_MESSAGES/gprof.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/bg/LC_MESSAGES/ld.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/ca from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/ca/LC_MESSAGES from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/ca/LC_MESSAGES/binutils.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/da from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/da/LC_MESSAGES from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/da/LC_MESSAGES/bfd.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/da/LC_MESSAGES/binutils.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/da/LC_MESSAGES/gprof.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/da/LC_MESSAGES/ld.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/da/LC_MESSAGES/opcodes.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/de from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/de/LC_MESSAGES from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/de/LC_MESSAGES/gprof.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/de/LC_MESSAGES/ld.mo from system_u:object_r:usr_t:s0 to system_u:object_r:locale_t:s0
Would relabel /opt/rh/gcc-toolset-12/root/usr/share/locale/de/LC_MESSAGES/opcodes.mo from system_u:object_r:usr_t:s0 to system_u:object_r:l





Expected results:
No relabelling required.




Additional info:
My opinion is to simply run restorecon on the offending directory within the postinstall script for package gcc-toolset-12-binutils.

--- Additional comment from Nick Clifton on 2023-08-21 15:02:47 UTC ---

Given that there is a workaround for the problem - I am of the opinion that it would be better to fix this for GTS-13/ RHEL 8.10 rather than applying for an exception+ for GTS-12/RHEL-8.9.

Comment 4 Nick Clifton 2023-09-13 09:35:56 UTC

Fixed in gcc-toolset-13-binutils-2.40-15.el9

Comment 6 Miloš Prchlík 2023-10-04 07:42:24 UTC

Bumping ITM - I did bump it Jira, but the bug has not been migrated yet, therefore it was the wrong place to update...

Comment 10 Miloš Prchlík 2023-10-13 07:23:37 UTC

Verified with gcc-toolset-13-binutils-2.40-15.el9:

:: [ 06:52:15 ] :: [  BEGIN   ] :: Running 'restorecon -Rvn /opt/rh/gcc-toolset-13/root'
:: [ 06:52:16 ] :: [   PASS   ] :: Command 'restorecon -Rvn /opt/rh/gcc-toolset-13/root' (Expected 0, got 0)
:: [ 06:52:16 ] :: [  BEGIN   ] :: Running 'grep 'Would relabel' /var/tmp/rlRun_LOG.5phDyowr'
:: [ 06:52:16 ] :: [   PASS   ] :: Command 'grep 'Would relabel' /var/tmp/rlRun_LOG.5phDyowr' (Expected 1, got 1)

Comment 12 errata-xmlrpc 2024-04-30 09:40:53 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (gcc-toolset-13-binutils bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2024:2151