Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1271338 - oo-restorecon -v -a does not add selinux MCS labels to files under hidden directory
oo-restorecon -v -a does not add selinux MCS labels to files under hidden di...
Status: CLOSED ERRATA
Product: OpenShift Container Platform
Classification: Red Hat
Component: Containers (Show other bugs)
2.2.0
Unspecified Unspecified
high Severity unspecified
: ---
: ---
Assigned To: Timothy Williams
chaoyang
:
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2015-10-13 13:02 EDT by Ryan Howe
Modified: 2015-12-17 13:17 EST (History)
8 users (show)

See Also:
Fixed In Version: openshift-origin-node-util-1.38.5.1-1.el6op
Doc Type: Bug Fix
Doc Text:
When restoring SELinux labels, the action was performed on a directory, which does not include hidden files. This caused SELinux labels to not be properly restored on hidden files within a gear directory if they were incorrect. This bug fix ensures that the SELinux label change is performed on all files within a directory, rather than the directory. As a result, hidden files in a gear now have the proper SELinux labels set when they are incorrect.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-12-17 12:11:11 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2666 normal SHIPPED_LIVE Important: Red Hat OpenShift Enterprise 2.2.8 security, bug fix, and enhancement update 2015-12-17 17:07:54 EST

  None (edit)
Description Ryan Howe 2015-10-13 13:02:58 EDT 
Description of problem:
 oo-restorecon -v -a  does not add selinux MCS labels to files under hidden directory 

example:   .env/* 

Version-Release number of selected component (if applicable):
v2.2.x

How reproducible:
100%

Steps to Reproduce:
1. mv /var/lib/openshift/<gearUUID>
2. lose selinux attributes 
3. run oo-restorecon -v -a 

Actual results:

# oo-restorecon -v -a
chcon -l s0:c86,c118 -R /var/lib/openshift/55f8844b8d24b7a8e50000a8/*
restorecon -R /var/lib/openshift/5602de3b8d24b7872c000878/
chcon -l s0:c82,c817 -R /var/lib/openshift/5602de3b8d24b7872c000878/*


# ls -lhaRZ .env/
.env/:
drwxr-x---. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 .
drwxr-x---. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 ..
-rw-r--r--. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 GEM_HOME
-rw-r--r--. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 HISTFILE
-rw-r--r--. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 HOME
-rw-r--r--. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0:c82,c817 JAVA_OPTS_EXT
-rw-r--r--. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 JENKINS_PASSWORD
-rw-r--r--. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 JENKINS_URL
-rw-r--r--. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 JENKINS_USERNAME
-rw-r--r--. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 OPENSHIFT_APP_DNS
-rw-r--r--. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 OPENSHIFT_APP_NAME
-rw-r--r--. root 5602de3b8d24b7872c000878 

.env/user_vars:
drwxrwx---. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 .
drwxr-x---. root 5602de3b8d24b7872c000878 system_u:object_r:openshift_var_lib_t:s0 ..


Expected results:

All attribute get restored. 


Additional info:
Comment 2 Josep 'Pep' Turro Mauri 2015-10-13 13:27:06 EDT 
Haven't tested but this should hopefully help:

https://github.com/openshift/origin-server/pull/6273
Comment 7 Johnny Liu 2015-11-18 02:35:49 EST 
Verified this bug with openshift-origin-node-util-1.38.5.1-1.el6op.noarch, and PASS.


# touch .env/bb

# ll -Z .env/bb
-rw-r--r--. root root unconfined_u:object_r:openshift_var_lib_t:s0 .env/bb

# oo-restorecon -v -a 
restorecon -R /var/lib/openshift/jialiu-python33app-1/
chcon -l s0:c6,c673 -R /var/lib/openshift/jialiu-python33app-1/

# ll -Z .env/bb
-rw-r--r--. root root unconfined_u:object_r:openshift_var_lib_t:s0:c6,c673 .env/bb
Comment 9 errata-xmlrpc 2015-12-17 12:11:11 EST 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2666.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.