Bug 1405441 - ip6tables service on EL 7.3 fails to start due to invalid context file
Summary: ip6tables service on EL 7.3 fails to start due to invalid context file
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.3
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
Depends On:
TreeView+ depends on / blocked
Reported: 2016-12-16 14:09 UTC by Fabian Arrotin
Modified: 2020-09-10 10:03 UTC (History)
9 users (show)

Fixed In Version: selinux-policy-3.13.1-124.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-08-01 15:20:12 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:1861 0 normal SHIPPED_LIVE selinux-policy bug fix update 2017-08-01 17:50:24 UTC

Description Fabian Arrotin 2016-12-16 14:09:08 UTC
Description of problem:

After having updated some nodes to 7.3 (but not rebooted) , ip6tables service doesn't (re)start as it has invalid context on the /var/lock/subsys/ip6tables

Version-Release number of selected component (if applicable):

How reproducible:

Have a el7.2 updated to 7.3, including a bump from those pkgs to newer versions:
selinux-policy-targeted-3.13.1-102.el7_3.7.noarch => selinux-policy-targeted-3.13.1-102.el7_3.7.noarch
iptables-services-1.4.21-16.el7.x86_64 => iptables-services-1.4.21-17.el7.x86_64

Actual results:
systemctl start ip6tables => fails

Expected results:
ip6tables service would succeed

Additional info:

on el7.2, the context for /var/lock/subsys/ip6tables was : 
-rw-r--r--. root root system_u:object_r:var_lock_t:s0  ip6tables

But it's now denied, so putting it to iptables_lock_t (like for iptables service) allow the service to start

Interesting : 
restorecon -Rv /var/lock/subsys/ip6tables 
restorecon:  Warning no default label for /run/lock/subsys/ip6tables

But a reboot seem to solve that issue (but rebooting a bunch of servers isn't the best idea either)

Comment 1 Thomas Woerner 2016-12-16 14:38:17 UTC
There has been no change in the iptables init script related to the subsys lock file path since 2004.

Comment 2 Thomas Woerner 2016-12-16 14:40:16 UTC
Reassigning to selinux-policy.

Comment 4 Milos Malik 2016-12-19 11:17:33 UTC
I believe this bug describes another aspect of the same problem as BZ#1376343 or BZ#1367520.

# matchpathcon /var/lock/subsys/iptables
/var/lock/subsys/iptables	system_u:object_r:iptables_lock_t:s0
# matchpathcon /var/lock/subsys/ip6tables
/var/lock/subsys/ip6tables	<<none>>

Comment 7 errata-xmlrpc 2017-08-01 15:20:12 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.