First Last Prev Next    This bug is not in your last search results.
Bug 1261989 - SELinux is preventing /usr/bin/python3.4 from 'relabelto' accesses on the file /var/lib/mock/fedora-22-x86_64/root/builddir/build/originals/policycoreutils-2.3-17.fc22.src.rpm.
SELinux is preventing /usr/bin/python3.4 from 'relabelto' accesses on the fil...
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
rawhide
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Lukas Vrabec
Fedora Extras Quality Assurance
abrt_hash:f0402ed66baa9957ea4065f89a0...
:
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2015-09-10 10:44 EDT by Petr Lautrbach
Modified: 2017-02-25 20:37 EST (History)
6 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-225.10.fc25
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-02-25 20:37:25 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Petr Lautrbach 2015-09-10 10:44:04 EDT 
Description of problem:
1. be staff_u
2. make a src.rpm
3. run mock -r fedora-22-x86_64 --rebuild src.rpm
SELinux is preventing /usr/bin/python3.4 from 'relabelto' accesses on the file /var/lib/mock/fedora-22-x86_64/root/builddir/build/originals/policycoreutils-2.3-17.fc22.src.rpm.

*****  Plugin restorecon_source (99.5 confidence) suggests   *****************

If you want to fix the label. 
/usr/bin/python3.4 default label should be bin_t.
Then you can run restorecon.
Do
# /sbin/restorecon -v /usr/bin/python3.4

*****  Plugin catchall (1.49 confidence) suggests   **************************

If you believe that python3.4 should be allowed relabelto access on the policycoreutils-2.3-17.fc22.src.rpm file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep mock /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                staff_u:staff_r:mock_t:s0-s0:c0.c1023
Target Context                staff_u:object_r:user_home_t:s0
Target Objects                /var/lib/mock/fedora-22-x86_64/root/builddir/build
                              /originals/policycoreutils-2.3-17.fc22.src.rpm [
                              file ]
Source                        mock
Source Path                   /usr/bin/python3.4
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           python3-3.4.3-5.fc23.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-146.fc23.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.2.0-0.rc8.git0.1.fc23.x86_64 #1
                              SMP Mon Aug 24 14:45:39 UTC 2015 x86_64 x86_64
Alert Count                   2
First Seen                    2015-09-10 16:38:29 CEST
Last Seen                     2015-09-10 16:39:43 CEST
Local ID                      437107b3-52e6-4a10-a56f-ca7984b874c8

Raw Audit Messages
type=AVC msg=audit(1441895983.82:3139): avc:  denied  { relabelto } for  pid=25976 comm="mock" name="policycoreutils-2.3-17.fc22.src.rpm" dev="dm-2" ino=29306 scontext=staff_u:staff_r:mock_t:s0-s0:c0.c1023 tcontext=staff_u:object_r:user_home_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1441895983.82:3139): arch=x86_64 syscall=setxattr success=no exit=EACCES a0=7f2348cccb78 a1=7f2348cd6210 a2=7f2348cd0830 a3=20 items=1 ppid=25975 pid=25976 auid=13558 uid=13558 gid=135 euid=13558 suid=0 fsuid=13558 egid=135 sgid=135 fsgid=135 tty=pts3 ses=9 comm=mock exe=/usr/bin/python3.4 subj=staff_u:staff_r:mock_t:s0-s0:c0.c1023 key=(null)

type=CWD msg=audit(1441895983.82:3139): cwd=/home/plautrba/devel/fedora/policycoreutils/f22

type=PATH msg=audit(1441895983.82:3139): item=0 name=/var/lib/mock/fedora-22-x86_64/root/builddir/build/originals/policycoreutils-2.3-17.fc22.src.rpm inode=29306 dev=fd:02 mode=0100664 ouid=13558 ogid=135 rdev=00:00 obj=staff_u:object_r:mock_var_lib_t:s0 nametype=NORMAL

Hash: mock,mock_t,user_home_t,file,relabelto

Version-Release number of selected component:
selinux-policy-3.13.1-146.fc23.noarch

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.2.0-0.rc8.git0.1.fc23.x86_64
type:           libreport
Comment 1 Miroslav Grepl 2015-09-10 11:08:24 EDT 
What does 

ls -dZ /var/lib/mock

show you?
Comment 2 Petr Lautrbach 2015-09-10 11:14:47 EDT 
mock traceback:

Traceback (most recent call last):
  File "/usr/sbin/mock", line 832, in <module>
    main()
  File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace
    result = func(*args, **kw)
  File "/usr/sbin/mock", line 649, in main
    run_command(options, args, config_opts, commands, buildroot, state)
  File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace
    result = func(*args, **kw)
  File "/usr/sbin/mock", line 729, in run_command
    do_rebuild(config_opts, commands, buildroot, args)
  File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace
    result = func(*args, **kw)
  File "/usr/sbin/mock", line 495, in do_rebuild
    post=post_build, clean=clean)
  File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace
    result = func(*args, **kw)
  File "/usr/sbin/mock", line 440, in rebuild_generic
    ret = cmd(item)
  File "/usr/sbin/mock", line 475, in build
    check=config_opts['check'])
  File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace
    result = func(*args, **kw)
  File "/usr/lib/python3.4/site-packages/mockbuild/backend.py", line 207, in build
    srpm = self.copy_srpm_into_chroot(srpm)
  File "/usr/lib/python3.4/site-packages/mockbuild/trace_decorator.py", line 84, in trace
    result = func(*args, **kw)
  File "/usr/lib/python3.4/site-packages/mockbuild/backend.py", line 364, in copy_srpm_into_chroot
    shutil.copy2(srpm_path, dest)
  File "/usr/lib64/python3.4/shutil.py", line 246, in copy2
    copystat(src, dst, follow_symlinks=follow_symlinks)
  File "/usr/lib64/python3.4/shutil.py", line 213, in copystat
    _copyxattr(src, dst, follow_symlinks=follow)
  File "/usr/lib64/python3.4/shutil.py", line 153, in _copyxattr
    os.setxattr(dst, name, value, follow_symlinks=follow_symlinks)
PermissionError: [Errno 13] Permission denied: '/var/lib/mock/fedora-22-x86_64/root/builddir/build/originals/policycoreutils-2.3-17.fc22.src.rpm'


mock tries to copy src.rpm and preserve all stat info including extended attributes what means that it tries to set  SELinux label of a new file to it's origin label, in this case it's user_home_t.

I'm not sure if it's really wanted behaviour as it would mean that there'll be files labeled with user_home_t in /var/lib/mock/

Mirek, is this intended?
Comment 3 Miroslav Suchý 2015-09-10 16:14:42 EDT 
Yes. Because mock is setting up the chroot environment in /var/lib/mock/fedora-22-x86_64/root/ and ./builddir/ is home (IIRC) of unprivileg user in that chroot. So from POV from inside of that chroot we want to have user_home_t on that file.
From POV from outside of that chroot it can look differtn and user_home_t is probably not the best option. But I do not know about better solution (and nobody required it).
Comment 4 Fedora Admin XMLRPC Client 2016-09-27 10:56:03 EDT 
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 5 Fedora End Of Life 2016-11-24 07:28:50 EST 
This message is a reminder that Fedora 23 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 23. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '23'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 23 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 6 Fedora Update System 2017-02-22 16:07:04 EST 
selinux-policy-3.13.1-225.10.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-31d4ea5eb1
Comment 7 Fedora Update System 2017-02-25 20:37:25 EST 
selinux-policy-3.13.1-225.10.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.