Bug 799817

Summary: SELinux policy missing postfix /lib64 fcontext in chroot
Product: [Fedora] Fedora Reporter: Scott Shambarger <scott-fedora>
Component: selinux-policyAssignee: Miroslav Grepl <mgrepl>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16CC: dominick.grift, dwalsh, mgrepl
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-23 00:06:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Scott Shambarger 2012-03-05 06:23:27 UTC 
Description of problem:
selinux-policy-targeted-3.10.0 is missing correct fcontext for /lib64

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.10.0-75
selinux-policy-targeted-3.10.0

How reproducible:
Anytime postfix smtpd uses libraries

Steps to Reproduce:
1. Install postfix with chroot enabled 64bit
2. Enable selinux
3. Attempt any function that requires a library in /lib64
  
Additional info:

Present in /etc/selinux/targeted/contexts/files/file_contexts
/var/spool/postfix/lib(/.*)?    system_u:object_r:lib_t:s0

Missing in /etc/selinux/targeted/contexts/files/file_contexts.subs
/var/spool/postfix/lib64 /var/spool/postfix/lib
Comment 1 Miroslav Grepl 2012-03-05 10:07:16 UTC 
You are right. This is a bug.
Comment 2 Scott Shambarger 2012-04-16 18:29:42 UTC 
This seems like an easy change... any chance it'll make it in the next release? (I'd love to remove my workaround)
Comment 3 Daniel Walsh 2012-04-20 14:29:24 UTC 
Added label to F17,
Comment 4 Miroslav Grepl 2012-04-20 15:24:57 UTC 
Should be fixed in the latest F16 policy.

$ yum update selinux-policy --enablerepo=updates-testing
Comment 5 Scott Shambarger 2012-04-23 18:30:04 UTC 
Is this present in 3.10.0-84? I don't see any labels for /var/spool/postfix/lib64 in that build...
Comment 6 Miroslav Grepl 2012-04-23 18:56:36 UTC 
yes, it is

$ matchpathcon /var/spool/postfix/lib64
Comment 7 Scott Shambarger 2012-04-23 20:07:30 UTC 
# rpm -q selinux-policy-targeted
selinux-policy-targeted-3.10.0-84.fc16.noarch
# matchpathcon /var/spool/postfix/lib64
/var/spool/postfix/lib64        system_u:object_r:postfix_spool_t:s0

... shouldn't the fcontext be lib_t?
Comment 8 Scott Shambarger 2012-05-18 15:39:21 UTC 
Tried with latest latest release (3.10.0-86), and it's finally included.  Appears to be fixed now, thanks! :)