Bug 1308698 - SELinux file contexts for RHCI ISO
SELinux file contexts for RHCI ISO
Status: CLOSED CURRENTRELEASE
Product: Red Hat Satellite 6
Classification: Red Hat
Component: SELinux (Show other bugs)
6.2.0
Unspecified Unspecified
unspecified Severity medium (vote)
: Unspecified
: --
Assigned To: Lukas Zapletal
Katello QA List
: Triaged
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-15 14:22 EST by Thom Carlin
Modified: 2017-09-19 13 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-23 06:34:44 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Thom Carlin 2016-02-15 14:22:53 EST
Description of problem:

"restorecon" should not have to change the type portion of the security context.

Version-Release number of selected component (if applicable):

TP2 RC9

How reproducible:

Believe 100%

Steps to Reproduce:
1. Install RHCI
2. Log in to run launch-fusor-installer
3. restorecon -RFvv /

Actual results:

Type portion of security context changes for some files

Expected results:

No type portion changes

Additional info:

Edited List:
* restorecon reset /dev/shm/pulse-shm-* context unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:user_tmpfs_t:s0
* restorecon reset /run/user/0/gvfs context unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:fusefs_t:s0
* restorecon reset /run/user/0/keyring-<string> context unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:gkeyringd_tmp_t:s0 (and contents)
* restorecon reset /run/rubygem-passenger/passenger.1.0.20480 context system_u:object_r:passenger_var_run_t:s0->system_u:object_r:var_run_t:s0 (and contents)
* restorecon reset /etc/grub.d/00_tuned context system_u:object_r:usr_t:s0->system_u:object_r:etc_t:s0
* restorecon reset /etc/foreman context system_u:object_r:etc_t:s0->system_u:object_r:foreman_config_t:s0 (and contents)
* restorecon reset /root/.config context system_u:object_r:admin_home_t:s0->system_u:object_r:config_home_t:s0 (and contents)
* restorecon reset /root/.Xauthority context unconfined_u:object_r:admin_home_t:s0->system_u:object_r:xauth_home_t:s0
* restorecon reset /usr/share/foreman/config/hooks context system_u:object_r:bin_t:s0->system_u:object_r:foreman_hook_t:s0
Comment 6 Thom Carlin 2016-07-25 16:12:58 EDT
/root/.config and /root/.Xauthority appear to be GNOME configuration files.  

I'm unclear why they have the wrong context.  The *corrected* file contexts match the policy in the system
Comment 7 Thom Carlin 2016-08-08 11:43:07 EDT
Per QCI devs, switching to Sat 6
Comment 8 Lukas Zapletal 2016-08-09 03:58:42 EDT
This is a bug in RHEL (SELinux tools) as we use context aliases. We can't do much about it. Asking Mirek to confirm.
Comment 9 Miroslav Grepl 2016-11-11 10:36:01 EST
(In reply to Lukas Zapletal from comment #8)
> This is a bug in RHEL (SELinux tools) as we use context aliases. We can't do
> much about it. Asking Mirek to confirm.

Could you elaborate it more?
Comment 10 Lukas Zapletal 2016-11-23 05:42:01 EST
You told me the oher day that if there's an alias defined, restorecon might restore the context incorrectly. And that's what I suppose is happening right here.

Anyway I was wrong, this is not the case, sorry and ignore.

Thom, I am unable to reproduce this in Satellite 6.3. Fresh install:

restorecon -RFvv /etc /usr/share/foreman
restorecon reset /etc/yum/pluginconf.d/langpacks.conf context system_u:object_r:etc_runtime_t:s0->system_u:object_r:etc_t:s0
restorecon reset /etc/mail/virtusertable.db context system_u:object_r:etc_mail_t:s0->system_u:object_r:etc_aliases_t:s0
restorecon reset /etc/mail/access.db context system_u:object_r:etc_mail_t:s0->system_u:object_r:etc_aliases_t:s0
restorecon reset /etc/mail/domaintable.db context system_u:object_r:etc_mail_t:s0->system_u:object_r:etc_aliases_t:s0
restorecon reset /etc/mail/mailertable.db context system_u:object_r:etc_mail_t:s0->system_u:object_r:etc_aliases_t:s0
restorecon reset /etc/mail/aliasesdb-stamp context system_u:object_r:etc_mail_t:s0->system_u:object_r:etc_aliases_t:s0
restorecon reset /etc/selinux/strict/active context system_u:object_r:semanage_store_t:s0->system_u:object_r:selinux_config_t:s0
restorecon reset /etc/selinux/strict/active/modules context system_u:object_r:semanage_store_t:s0->system_u:object_r:selinux_config_t:s0
restorecon reset /etc/chrony.conf.orig context system_u:object_r:etc_runtime_t:s0->system_u:object_r:etc_t:s0
restorecon reset /etc/beah_beaker.conf.default context system_u:object_r:etc_runtime_t:s0->system_u:object_r:etc_t:s0
restorecon reset /etc/beah.conf.default context system_u:object_r:etc_runtime_t:s0->system_u:object_r:etc_t:s0

All files are labelled fine.

Please provide Satellite 6 reproducer or talk to RHCI devs to fix your policy if you changed something.
Comment 11 Thom Carlin 2016-11-23 06:34:44 EST
lzap: Seems reasonable to me.

Since this was opened so long ago and things have changed dramatically with QCI, closing as currentrelease.   Will reopen with reproducer or open a new case if this reoccurs.

Note You need to log in before you can comment on or make changes to this bug.