Bug 1461313 - Rebuilding of rpm db set wrong SELinux context
Rebuilding of rpm db set wrong SELinux context
Status: NEW
Product: Fedora
Classification: Fedora
Component: rpm (Show other bugs)
26
All Linux
unspecified Severity high
: ---
: ---
Assigned To: packaging-team-maint
Fedora Extras Quality Assurance
:
: 1435992 1487104 (view as bug list)
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-14 03:53 EDT by Lukas Slebodnik
Modified: 2017-10-08 06:33 EDT (History)
16 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
This is a suggested patch to solve the issue. (832 bytes, patch)
2017-08-09 13:13 EDT, Villy Kruse
no flags Details | Diff

  None (edit)
Description Lukas Slebodnik 2017-06-14 03:53:23 EDT
Description of problem:
It seems that "rpm --rebuilddb" is mention quite often these days due to libdb bug. e.g. https://www.happyassassin.net/2017/06/09/psa-rpm-database-issues-after-update-to-libdb-5-3-28-21-on-fedora-24-and-fedora-25/

However, it has a small site effect. The SELinux type is changed to "var_lib_t" instead of "rpm_var_lib_t". And it cuases a problem for SELinux troubleshooter.

Jun 14 09:32:14 host.example.com python3[13582]: detected unhandled Python exception in '/usr/sbin/setroubleshootd'

Jun 14 09:32:14 host.example.com abrt-notification[13623]: Process 13582 (setroubleshootd) of user 984 encountered an uncaught SystemExit exception



Version-Release number of selected component (if applicable):
sh$ rpm -q rpm selinux-policy
rpm-4.13.0.1-4.fc26.x86_64
selinux-policy-3.13.1-257.fc26.noarch

How reproducible:
Deterministic

Steps to Reproduce:
1. rpm --rebuilddb
2. ls -lZ /var/lib/rpm/

Actual results:
[root@host ~]# rpm --rebuilddb 
[root@host ~]# ls -lZ /var/lib/rpm/
total 95724
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0  8830976 Jun 14 09:49 Basenames
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0    16384 Jun 14 09:49 Conflictname
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0  3821568 Jun 14 09:49 Dirnames
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0     8192 Jun 14 09:49 Enhancename
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0     8192 Jun 14 09:49 Filetriggername
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0    36864 Jun 14 09:49 Group
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0    40960 Jun 14 09:49 Installtid
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0   118784 Jun 14 09:49 Name
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0    40960 Jun 14 09:49 Obsoletename
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0 82808832 Jun 14 09:49 Packages
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0  1282048 Jun 14 09:49 Providename
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0     8192 Jun 14 09:49 Recommendname
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0   655360 Jun 14 09:49 Requirename
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0   192512 Jun 14 09:49 Sha1header
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0   131072 Jun 14 09:49 Sigmd5
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0     8192 Jun 14 09:49 Suggestname
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0     8192 Jun 14 09:49 Supplementname
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0     8192 Jun 14 09:49 Transfiletriggername
-rw-r--r--. 1 root root unconfined_u:object_r:var_lib_t:s0     8192 Jun 14 09:49 Triggername


Expected results:
[root@host ~]# rpm --rebuilddb
[root@host ~]# ls -lZ /var/lib/rpm/
total 95724
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0  8830976 Jun 14 09:49 Basenames
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0    16384 Jun 14 09:49 Conflictname
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0  3821568 Jun 14 09:49 Dirnames
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Enhancename
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Filetriggername
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0    36864 Jun 14 09:49 Group
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0    40960 Jun 14 09:49 Installtid
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0   118784 Jun 14 09:49 Name
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0    40960 Jun 14 09:49 Obsoletename
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0 82808832 Jun 14 09:49 Packages
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0  1282048 Jun 14 09:49 Providename
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Recommendname
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0   655360 Jun 14 09:49 Requirename
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0   192512 Jun 14 09:49 Sha1header
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0   131072 Jun 14 09:49 Sigmd5
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Suggestname
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Supplementname
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Transfiletriggername
-rw-r--r--. 1 root root unconfined_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Triggername

or even better
[root@host ~]# ls -lZ /var/lib/rpm/
total 95724
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0  8830976 Jun 14 09:49 Basenames
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0    16384 Jun 14 09:49 Conflictname
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0  3821568 Jun 14 09:49 Dirnames
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Enhancename
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Filetriggername
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0    36864 Jun 14 09:49 Group
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0    40960 Jun 14 09:49 Installtid
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0   118784 Jun 14 09:49 Name
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0    40960 Jun 14 09:49 Obsoletename
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0 82808832 Jun 14 09:49 Packages
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0  1282048 Jun 14 09:49 Providename
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Recommendname
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0   655360 Jun 14 09:49 Requirename
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0   192512 Jun 14 09:49 Sha1header
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0   131072 Jun 14 09:49 Sigmd5
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Suggestname
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Supplementname
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Transfiletriggername
-rw-r--r--. 1 root root system_u:object_r:rpm_var_lib_t:s0     8192 Jun 14 09:49 Triggername


Additional info:
[root@host ~]# matchpathcon /var/lib/rpm/*
/var/lib/rpm/Basenames  system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Conflictname       system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Dirnames   system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Enhancename        system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Filetriggername    system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Group      system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Installtid system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Name       system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Obsoletename       system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Packages   system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Providename        system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Recommendname      system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Requirename        system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Sha1header system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Sigmd5     system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Suggestname        system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Supplementname     system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Transfiletriggername       system_u:object_r:rpm_var_lib_t:s0
/var/lib/rpm/Triggername        system_u:object_r:rpm_var_lib_t:s0
Comment 1 Lukas Slebodnik 2017-06-14 03:55:51 EDT
Workaround is quite simple. Restore context after rebuiding rpm db

rpm --rebuilddb
restorecon -RFv /var/lib/rpm
Comment 2 Lukas Slebodnik 2017-06-14 04:08:33 EDT
Jun 14 10:05:38 host.example.com audit[14176]: AVC avc:  denied  { read } for  pid=14176 comm="setroubleshootd" name="Packages" dev="dm-1" ino=8361242 scontext=system_u:system_r:setroubleshootd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_lib_t:s0 tclass=file permissive=0
Jun 14 10:05:38 host.example.com org.fedoraproject.Setroubleshootd[1138]: error: cannot open Packages index using db5 - Permission denied (13)
Jun 14 10:05:38 host.example.com org.fedoraproject.Setroubleshootd[1138]: error: cannot open Packages database in /var/lib/rpm
Jun 14 10:05:38 host.example.com setroubleshoot[14176]: failed to get filesystem list from rpm
Jun 14 10:05:38 host.example.com dbus-daemon[1138]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Jun 14 10:05:41 host.example.com sedispatch[1104]: AVC Message for setroubleshoot, dropping message
Comment 3 Florian Festi 2017-06-14 07:35:04 EDT
There is a line in the selinux policy (in /etc/selinux/targeted/contexts/files/file_contexts) that should actually prevent this:

/var/lib/rpmrebuilddb.*(/.*)?	system_u:object_r:rpm_var_lib_t:s0

I am not quite getting why this doesn't work. As the rpmdb gets recreated in /var/lib/rpmrebuilddb.17078 on my machine which looks like it should match the RE. SELinux content is wrong, though...
Comment 4 Lukas Slebodnik 2017-06-15 10:59:17 EDT
Lukas,

Coudl you (or sb else from SELinux team) help  Florian to fix it?
Comment 5 Florian Festi 2017-06-29 04:25:55 EDT
Ok, turns out rpm used to set the SELinux context explicitly in the past. b5e3e1efee28ce0a4bb5e9eae6740d4422f75f1c removed his functionality to get rid of the SELinux dependency in the core code. So this is clearly caused by a change in rpm.

I still think the policy from #3 should actually do the trick - although it doesn't.
Comment 6 Lukas Slebodnik 2017-07-04 03:29:58 EDT
Florian,
I briefly checked selinux bugs in fedora and I found 4 tickets which are caused by this bug.

https://bugzilla.redhat.com/show_bug.cgi?id=1389836
https://bugzilla.redhat.com/show_bug.cgi?id=1430624
https://bugzilla.redhat.com/show_bug.cgi?id=1435992
https://bugzilla.redhat.com/show_bug.cgi?id=1436023

I would be really good to move forward this BZ.
Comment 7 Lukas Vrabec 2017-07-04 05:54:58 EDT
*** Bug 1435992 has been marked as a duplicate of this bug. ***
Comment 8 Lukas Slebodnik 2017-07-04 06:24:09 EDT
Adam,

Could you update your blog post? (for now)
https://fedoramagazine.org/psa-errors-updating-libdb/
Comment 9 Adam Williamson 2017-07-17 19:18:19 EDT
It seems I can't actually edit a post that's been published. I'm trying to find someone who can let me edit it now.
Comment 10 Adam Williamson 2017-07-18 21:31:40 EDT
I've now edited the blog post, and also the Common Bugs entries that mention the rebuilding the database.
Comment 11 Lukas Slebodnik 2017-07-19 03:47:14 EDT
Adding back needinfo to LukasV @see comment4
Comment 12 Villy Kruse 2017-08-02 10:55:51 EDT
(In reply to Florian Festi from comment #3)
> There is a line in the selinux policy (in
> /etc/selinux/targeted/contexts/files/file_contexts) that should actually
> prevent this:
> 
> /var/lib/rpmrebuilddb.*(/.*)?	system_u:object_r:rpm_var_lib_t:s0
> 
> I am not quite getting why this doesn't work. As the rpmdb gets recreated in
> /var/lib/rpmrebuilddb.17078 on my machine which looks like it should match
> the RE. SELinux content is wrong, though...

If you instead of creating /var/lib/rpmrebuilddb.$$ create the temporary directory as a subdirectory of /var/lib/rpm, then the selinux labels would be inherited from /var/lib/rpm, and the label will be correct; also after moving the file to the finale destination in /var/lib/rpm.   I don't know if that is how you want to fix this issue.
Comment 13 Villy Kruse 2017-08-09 13:13 EDT
Created attachment 1311320 [details]
This is a suggested patch to solve the issue.

The idea is to work in a subdirectory of /var/lib/rpm, and by doing this, all selinux labels will by default be inherited from /var/lib/rpm.  Assuming that the directory /var/lib/rpm is labeled correctly, then all the new database file will also be labeled correctly
Comment 14 Lukas Slebodnik 2017-08-12 15:23:51 EDT
(In reply to Villy Kruse from comment #13)
> Created attachment 1311320 [details]
> This is a suggested patch to solve the issue.
> 
> The idea is to work in a subdirectory of /var/lib/rpm, and by doing this,
> all selinux labels will by default be inherited from /var/lib/rpm.  Assuming
> that the directory /var/lib/rpm is labeled correctly, then all the new
> database file will also be labeled correctly

I am not a rpm developer. But I would like let you know that patch broke unit tests:
RPM database access

 59: rpm --initdb                                    ok
 60: rpm -qa                                         ok
 61: rpm -q foo                                      ok
 62: rpm -q foo-                                     ok
 63: rpm -i *.noarch.rpm                             ok
 64: rpm -U --replacepkgs 1                          ok
 65: rpm -U --replacepkgs 2                          expected failure (rpmdb.at:131)
 66: rpm --reinstall 1                               ok
 67: rpm -i --relocate=.. *.i386.rpm                 ok
 68: rpm -i --relocate=.. *.ppc64.rpm                ok
 69: rpmdb --rebuilddb                               FAILED (rpmdb.at:210)
Comment 15 Villy Kruse 2017-08-13 08:02:15 EDT
(In reply to Lukas Slebodnik from comment #14)
> (In reply to Villy Kruse from comment #13)
> > Created attachment 1311320 [details]
> > This is a suggested patch to solve the issue.
> > 
> > The idea is to work in a subdirectory of /var/lib/rpm, and by doing this,
> > all selinux labels will by default be inherited from /var/lib/rpm.  Assuming
> > that the directory /var/lib/rpm is labeled correctly, then all the new
> > database file will also be labeled correctly
> 
> I am not a rpm developer. But I would like let you know that patch broke
> unit tests:
> RPM database access
> 
>  59: rpm --initdb                                    ok
>  60: rpm -qa                                         ok
>  61: rpm -q foo                                      ok
>  62: rpm -q foo-                                     ok
>  63: rpm -i *.noarch.rpm                             ok
>  64: rpm -U --replacepkgs 1                          ok
>  65: rpm -U --replacepkgs 2                          expected failure
> (rpmdb.at:131)
>  66: rpm --reinstall 1                               ok
>  67: rpm -i --relocate=.. *.i386.rpm                 ok
>  68: rpm -i --relocate=.. *.ppc64.rpm                ok
>  69: rpmdb --rebuilddb                               FAILED (rpmdb.at:210)


I am not either.  I don't get that test failure, though

RPM database access

 38: rpm --initdb                                    ok
 39: rpm -qa                                         ok
 40: rpm -q foo                                      ok
 41: rpm -q foo-                                     ok
 42: rpm -i *.noarch.rpm                             ok
 43: rpm -U --replacepkgs 1                          ok
 44: rpm -U --replacepkgs 2                          expected failure (rpmdb.at:131)
 45: rpm --reinstall 1                               ok
 46: rpm -i --relocate=.. *.i386.rpm                 ok
 47: rpm -i --relocate=.. *.ppc64.rpm                ok
 48: rpmdb --rebuilddb                               ok
 49: rpm -U and verify status                        ok
 50: rpm -U with _install_lang and verify status     ok
 51: rpm -U and verify files on disk                 ok
 52: rpm -e and verify files removed                 ok

Based on rpm-4.13.0.1-5.fc26.src.rpm + a patch to fix the NSS problem.
commit 36db47bf59213befbb0afb37032b82e634c7ba78
Author: Panu Matilainen <pmatilai@redhat.com>
Date:   Wed May 10 09:17:20 2017 +0300
Comment 16 Villy Kruse 2017-08-13 15:25:27 EDT
Another posible solution is to install policycoreutils-restorecond

Edit /etc/selinux/restorecond.conf

--- /etc/selinux/restorecond.conf
+++ /etc/selinux/restorecond.conf
@@ -4,5 +4,6 @@
 /etc/updatedb.conf
 /var/run/utmp
 /var/log/wtmp
+/var/lib/rpm/*
 /root/*
 /root/.ssh/*

And run systemctl status restorecond.service
Comment 17 Lukas Slebodnik 2017-08-14 04:49:10 EDT
(In reply to Villy Kruse from comment #15)
> 
> RPM database access
> 
>  38: rpm --initdb                                    ok
>  39: rpm -qa                                         ok
>  40: rpm -q foo                                      ok
>  41: rpm -q foo-                                     ok
>  42: rpm -i *.noarch.rpm                             ok
>  43: rpm -U --replacepkgs 1                          ok
>  44: rpm -U --replacepkgs 2                          expected failure
> (rpmdb.at:131)
>  45: rpm --reinstall 1                               ok
>  46: rpm -i --relocate=.. *.i386.rpm                 ok
>  47: rpm -i --relocate=.. *.ppc64.rpm                ok
>  48: rpmdb --rebuilddb                               ok
>  49: rpm -U and verify status                        ok
>  50: rpm -U with _install_lang and verify status     ok
>  51: rpm -U and verify files on disk                 ok
>  52: rpm -e and verify files removed                 ok
> 
> Based on rpm-4.13.0.1-5.fc26.src.rpm + a patch to fix the NSS problem.
> commit 36db47bf59213befbb0afb37032b82e634c7ba78
> Author: Panu Matilainen <pmatilai@redhat.com>
> Date:   Wed May 10 09:17:20 2017 +0300

It passed on f26 
https://koji.fedoraproject.org/koji/taskinfo?taskID=21221554
but the same patch failed on rawhide
https://koji.fedoraproject.org/koji/taskinfo?taskID=21221393
Comment 18 Lukas Vrabec 2017-08-14 06:21:54 EDT
Late on party, Sorry guys. 

What is state of implementation in rpm right now? If is using tmpfiles with dir.XXX this is not easy from SELinux pov. Personally I prefer solution from comment#13. 

We're missing label for /var/lib/rpmrebuilddb.*(/.*)?  this should be added to policy. But please let me know how it's working right now on F26 and Rawhide. 

Thanks,
Lukas.
Comment 19 Villy Kruse 2017-08-14 07:36:07 EDT
(In reply to Lukas Vrabec from comment #18)
> Late on party, Sorry guys. 
> 
> What is state of implementation in rpm right now? If is using tmpfiles with
> dir.XXX this is not easy from SELinux pov. Personally I prefer solution from
> comment#13. 
> 
> We're missing label for /var/lib/rpmrebuilddb.*(/.*)?  this should be added
> to policy. But please let me know how it's working right now on F26 and
> Rawhide. 
> 
> Thanks,
> Lukas.

Solution from comment#13 does not work after this commit:

Author: Florian Festi <ffesti@redhat.com>  2017-06-29 09:08:32
Committer: Florian Festi <ffesti@redhat.com>  2017-07-30 11:06:47
Parent: 98efb7f6dc222ed175516298a34e807053d125f4 (reference proper debug files whenever RemovePathPostfixes is used)
Child:  4b0356c5671daafb954c8ee932742ad7da57f345 (Set permissions and owner for new database to the old values)
Branches: master, remotes/origin/master, remotes/origin/rpm-4.14.x
Follows: rpm-4.13.0-alpha
Precedes:

    Replace whole rpmdb directory on rebuilddb instead of moving around files

    This fixes issues with rebuilding the database for another backend which before could leave behind files from the old format.

------
/var/lib/rpmrebuilddb.*(/.*)?  is there already, but has no effect until you
run restorecon.
Comment 20 Igor Gnatenko 2017-08-31 05:27:14 EDT
*** Bug 1487104 has been marked as a duplicate of this bug. ***
Comment 21 Villy Kruse 2017-10-08 06:33:37 EDT
A SELinux solution turns out to be quite simple.  The problem is that when you run the rpm command the rpm and and rpmdb processes run in a unconfined_t context.  If you make sure rpm runs in the rpm_t context, the rebuilt data files will have the correct SELinux labels.

A cil format module fixes this problem for me:

==============8X======================
(typeattributeset cil_gen_require rpm_exec_t)
(typeattributeset cil_gen_require rpm_t)
(typeattributeset cil_gen_require unconfined_t)

(typetransition unconfined_t rpm_exec_t process rpm_t)

==============8X======================

Tested in Fedora 26 and 27.

Note You need to log in before you can comment on or make changes to this bug.