Bug 1406860 - restorecon location in /usr/libexec/iptables/iptables.init in assumed incorrectly
Summary: restorecon location in /usr/libexec/iptables/iptables.init in assumed incorre...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: iptables
Version: 7.3
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Phil Sutter
QA Contact: Tomas Dolezal
URL:
Whiteboard:
Depends On:
Blocks: 1472751 1489118
TreeView+ depends on / blocked
 
Reported: 2016-12-21 16:45 UTC by Andrew Tumelty
Modified: 2018-04-10 11:28 UTC (History)
8 users (show)

Fixed In Version: iptables-1.4.21-22.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1246380
: 1489118 (view as bug list)
Environment:
Last Closed: 2018-04-10 11:28:02 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2018:0715 0 normal SHIPPED_LIVE iptables bug fix and enhancement update 2018-04-10 16:09:27 UTC

Description Andrew Tumelty 2016-12-21 16:45:46 UTC
As part of Bug #1246380, a check was introduced to ensure restorecon was available. The check that has been introduced assumes restorecon is available at /bin/restorecon. See lines 32-33 of /usr/libexec/iptables/iptables.init:

RESTORECON=/bin/restorecon
[ ! -x "$RESTORECON" ] && RESTORECON=/bin/true

This means for systems with restorecon at a different location (such as /sbin/restorecon), restorecon is never ran against stored iptables data, resulting in an error when starting iptables if data had previously been stored with an incorrect context: "iptables: Applying firewall rules: Can't open /etc/sysconfig/iptables: Permission denied"

This was introduced in iptables-services-1.4.21-17.el7.x86_64

# rpm -q iptables-services
iptables-services-1.4.21-17.el7.x86_64

Comment 3 Phil Sutter 2017-09-06 17:52:32 UTC
OK, so my proposed solution is to use which:

RESTORECON=$(which restorecon)

This works fine, but only after adjusting selinux policies. After loading the following module into the kernel, everything works fine:

module iptables.init_restorecon 1.0;

require {
	type setfiles_exec_t;
	type iptables_t;
	class file { execute getattr };
}

#============= iptables_t ==============
allow iptables_t setfiles_exec_t:file { execute getattr };

Comment 8 errata-xmlrpc 2018-04-10 11:28:02 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:0715


Note You need to log in before you can comment on or make changes to this bug.