Bug 2339059

Summary: memcached selinux not labeling /run/memcached
Product: [Fedora] Fedora Reporter: Scott Shambarger <scott-fedora>
Component: memcachedAssignee: Tomas Korbar <tkorbar>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 41CC: jorton, moguimar, tkorbar
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: memcached-1.6.37-2.fc42 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-03-16 00:15:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Scott Shambarger 2025-01-20 20:46:24 UTC 
memcached pulls in memcached-selinux

memcached-selinux (as of 1.0.2) has not been updated with the new labeling priority to use /run in favor of /var/run for runtime labels

--- memcached.fc
/var/run/ipa_memcached(/.*)?	gen_context(system_u:object_r:memcached_var_run_t,s0)
/var/run/memcached(/.*)?	gen_context(system_u:object_r:memcached_var_run_t,s0)
---

The result is that the label for /var/run/memcached is masked by the /run/* label


Reproducible: Always

Steps to Reproduce:
1. chcon -t memcached_var_run_t /run/memcached
2. restorecon -v /run/memcached

Actual Results:  
Relabeled /run/memcached from system_u:object_r:memcached_var_run_t:s0 to system_u:object_r:var_run_t:s0

Expected Results:  
No output, label on /run/memcached remains at memcached_var_run_t

The refpolicy correctly uses /run/memcached. The fedora specific policy should follow the same pattern

The workaround is to create a manual override with

semanage fcontext -a  -t memcached_var_run_t '/run/memcached(/.*)?'
restorecon -RFv /run/memcached
Comment 1 Fedora Update System 2025-03-07 14:38:16 UTC 
FEDORA-2025-80ca3e9413 (memcached-1.6.37-2.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-80ca3e9413
Comment 2 Fedora Update System 2025-03-08 02:58:43 UTC 
FEDORA-2025-80ca3e9413 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-80ca3e9413`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-80ca3e9413

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 3 Scott Shambarger 2025-03-08 04:41:26 UTC 
I don't have F42 installed to test, but the patch to selinux looks like it fixes the problem!
Comment 4 Fedora Update System 2025-03-16 00:15:52 UTC 
FEDORA-2025-80ca3e9413 (memcached-1.6.37-2.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.