RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:

Interface logging_send_syslog_msg does not compile anymore when used with apache template type.

Version-Release number of selected component (if applicable):

# rpm -qa *selinux*
foreman-selinux-1.7.2.8-1.el7sat.noarch
selinux-policy-3.13.1-23.el7.noarch
libselinux-utils-2.2.2-6.el7.x86_64
libselinux-ruby-2.2.2-6.el7.x86_64
libselinux-2.2.2-6.el7.x86_64
selinux-policy-devel-3.13.1-23.el7.noarch
selinux-policy-targeted-3.13.1-23.el7.noarch
libselinux-python-2.2.2-6.el7.x86_64
candlepin-selinux-0.9.43-1.el7.noarch
pulp-selinux-2.6.0-0.7.beta.1.el7sat.noarch

How reproducible:

Always.

apache_content_template(foreman)
logging_send_syslog_msg(httpd_foreman_script_t)

Actual results:

/usr/bin/checkmodule:  loading policy configuration from tmp/foreman.tmp
foreman.te":148:ERROR 'unknown type httpd_foreman_script_t' at token ';' on line 4713:
#line 148
        typeattribute httpd_foreman_script_t syslog_client_type;
/usr/bin/checkmodule:  error(s) encountered while parsing configuration

Expected results:

It does compile as it was on RHEL 7.0.

Additional info:

Regression from 7.0

Yes, there is a bug in

apache_content_template()

where we miss typealias.

Can you remind me what was the workaround for this? You mentioned that the missing type is just an alias or something.

There is no good workaround. You should replace httpd_foreman_script_t by foreman_script_t which is only RHEL7.1 specific and you would break your policy.

You can define this alias but it will be a conflict with a fix in our policy. So we would need to have a conflict handling here.

Ok, it looks like selinux does not fail runtime, only compilation time. When we upgrade to RHEL 7.1 our policy does load fine. How is this possible? I'd expect it to fail.

commit 6b91dc9f5ac61b61afaa60b79f78d77227d0c6bb
Author: Miroslav Grepl <mgrepl>
Date:   Tue May 5 11:17:50 2015 +0200

    Add missing typealiases in apache_content_template() for script domain/executable.

I needed to revert it. It causes another issues.

What is the status then?

There is

apache_content_alias_template() 

interface which you should call to resolve it. So

apache_content_alias_template(foreman,foreman)