From Bugzilla Helper: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; AT&T CSM6.0) Description of problem: switchExecType() (lib/psm.c) simply strips the value after the last : in the security context and replaces it with the new type. This breaks when MLS is enabled since MLS range is the fourth element of the security context. Thus the code replaces a part or the entire MLS range with a new domain. Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: Run rpm on a SELinux system with MLS enabled. Additional info:
Created attachment 103127 [details] Fix for MLS bug
With the mls.patch applied, rpm will always run scriptlets in the correct security context regardless of whether MLS is enabled or not. Please apply. rpm-4.3.2/lib/psm.c | 23 ++++++++++++++++++++--- 1 files changed, 20 insertions(+), 3 deletions(-)
Fixed by using rpm_execcon, a execve clone, from libselinux in rpm-4.3.3-1.