This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 1024963 - lost+found SELinux context
lost+found SELinux context
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
All Linux
medium Severity medium
: rc
: ---
Assigned To: Miroslav Grepl
BaseOS QE Security Team
Depends On:
  Show dependency treegraph
Reported: 2013-10-30 12:32 EDT by Julio Entrena Perez
Modified: 2013-11-11 12:17 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-11-11 12:17:10 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 526083 None None None Never

  None (edit)
Description Julio Entrena Perez 2013-10-30 12:32:02 EDT
Description of problem:
A customer is mounting a filesystem under /var/lib/pgsql in their Satellite 5.6 and database installation fails with "The directory /var/lib/pgsql does not seem to have correct SELinux context."

As per /usr/bin/spacewalk-setup-postgresql line 109 will cause 'restorecon' to report any entry which does not have the expected security context (according to the current policy) and line 110 will indeed stop the installation if output of line 109 is not empty:

104     if [ ! -d "$PG_DATA/base" ] ; then
105         if /usr/sbin/selinuxenabled; then
106             SEMODE=$(/usr/sbin/getenforce)
107             if [ "$SEMODE" = 'Permissive' -o "$SEMODE" = 'Enforcing' ]; then
108                 PGHOME=$(getent passwd postgres | awk -F: '{print $6}')
109                 RCONOUT=$(/sbin/restorecon -Rnv $PGHOME)
110                 if [ -n "$RCONOUT" ]; then
111                     echo
112                     echo "The directory \"$PGHOME\" does not seem to have correct SELinux context."
113                     echo
114                     echo "Please fix the SELinux context by running:"
115                     echo
116                     echo "    restorecon -Rv $PGHOME"
117                     echo
118                     exit 1
119                 fi
120             fi
121         fi
122         postgresql_service initdb
123     fi

The problem is triggered by the "lost+found" directory which has "system_u:object_r:lost_found_t:s0" security context but, according to the policy (targeted-3.7.19-195.el6), should have "system_u:object_r:postgresql_db_t:s0" instead:

# ls -ldZ /var/lib/pgsql
drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 /var/lib/pgsql
# ls -lZ /var/lib/pgsql
drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 backups
drwx------. postgres postgres system_u:object_r:postgresql_db_t:s0 data
drwx------. root     root     system_u:object_r:lost_found_t:s0 lost+found            <---
-rw-------. postgres postgres unconfined_u:object_r:postgresql_log_t:s0 pgstartup.log

# semanage fcontext -l | grep lost
# semanage fcontext -l | grep pgsql

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Mount a filesystem in a location other than /, /boot, /tmp, /usr, /var and /var/tmp (so none of the policy rules for lost+found apply, see "semanage fcontext -l | grep lost").
2. Run "restorecon -Rv" in the location where the filesystem has been mounted.

Actual results:
lost+found directory ends with whatever context the policy mandates for that location.

Expected results:
lost+found directory ends with "system_u:object_r:lost_found_t:s0" context.

Additional info:
Comment 7 Daniel Walsh 2013-11-04 11:55:17 EST
When we have generic content we label it it lost_found_t.  When it is on a file sytstem with all the same labels it label it with the label of that directory.

It is arguable whether or not we should have any label for this any longer.
Comment 9 Daniel Walsh 2013-11-11 12:17:10 EST
This is not a bug.  lost+found should be labeled after the content that is likely to be in those directories.

Note You need to log in before you can comment on or make changes to this bug.