Red Hat Bugzilla – Bug 1308704
SELinux file contexts for TripleO ISO
Last modified: 2017-08-17 06:54:44 EDT
Description of problem: "restorecon" should not have to change the type portion of the security context. Version-Release number of selected component (if applicable): TP2 RC9 How reproducible: Believe 100% Steps to Reproduce: 1. Install TripleO ISO 2. Log in to run launch-fusor-undercloud-installer 3. restorecon -RFvv / Actual results: Type portion of security context changes for some files Expected results: No type portion changes Additional info: Edited List: * restorecon reset /dev/shm/pulse-shm-* context unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:user_tmpfs_t:s0 * restorecon reset /run/netns/qdhcp-* context system_u:object_r:proc_t:s0->system_u:object_r:ifconfig_var_run_t:s0 <- Not sure about this one * restorecon reset /run/user/0/gvfs context unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:fusefs_t:s0 * restorecon reset /run/user/0/keyring-<string> context unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:gkeyringd_tmp_t:s0 (and contents) * restorecon reset /etc/sysconfig/network context unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:etc_t:s0 * restorecon reset /root/.config context system_u:object_r:admin_home_t:s0->system_u:object_r:config_home_t:s0 (and contents) * restorecon reset /root/.Xauthority context unconfined_u:object_r:admin_home_t:s0->system_u:object_r:xauth_home_t:s0 * restorecon reset /var/lib/heat-cfntools/cfn-init-data context unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:var_lib_t:s0 * restorecon reset /var/log/yum.log context unconfined_u:object_r:var_log_t:s0->system_u:object_r:rpm_log_t:s0
In QCI 1.0: type=AVC msg=audit(1470268404.190:354): avc: denied { create } for pid=10341 comm="gdm-session-wor" name=".cache" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir type=AVC msg=audit(1470281262.458:1948): avc: denied { dac_override } for pid=20052 comm="ovs-vsctl" capability=1 scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=capability
Per QCI developers, switching to RHEL
Is it still relevant? Do you still see mislabeled files when running restorecon in this scenario?
No, this is no longer needed
Thanks Thom