Red Hat Bugzilla – Bug 1530601
SELinux filecontext for /var/lock/ppp is not set upon package installation
Last modified: 2018-04-10 08:48:22 EDT
Description of problem: SELinux filecontext for /var/lock/ppp is not set upon package installation. Package installs the directory with "unconfined_u:object_r:var_lock_t:s0" instead of "system_u:object_r:pppd_lock_t:s0". Version-Release number of selected component (if applicable): ppp-2.4.5-33.el7.x86_64 How reproducible: ALWAYS Steps to Reproduce: 1. Install the ppp package
There is no type_transition rule in the policy that would ensure that /var/lock/ppp gets a correct context when it's created: # sesearch -T | grep pppd_lock_t # If there was such a rule, the /var/lock/ppp directory would be labeled correctly by rpm/yum during the installation of ppp package. # ls -dZ /var/lock/ppp ls: cannot access /var/lock/ppp: No such file or directory # yum -y install ppp Loaded plugins: product-id, search-disabled-repos, subscription-manager This system is not registered with an entitlement server. You can use subscription-manager to register. Resolving Dependencies --> Running transaction check ---> Package ppp.x86_64 0:2.4.5-33.el7 will be installed --> Finished Dependency Resolution Dependencies Resolved ================================================================================ Package Arch Version Repository Size ================================================================================ Installing: ppp x86_64 2.4.5-33.el7 rhel 357 k Transaction Summary ================================================================================ Install 1 Package Total download size: 357 k Installed size: 852 k Downloading packages: ppp-2.4.5-33.el7.x86_64.rpm | 357 kB 00:00 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing : ppp-2.4.5-33.el7.x86_64 1/1 Verifying : ppp-2.4.5-33.el7.x86_64 1/1 Installed: ppp.x86_64 0:2.4.5-33.el7 Complete! # ls -dZ /var/lock/ppp drwxr-xr-x. root root unconfined_u:object_r:pppd_lock_t:s0 /var/lock/ppp # Following policy module brings such a rule: # cat mypolicy.te policy_module(mypolicy,1.0) require { type rpm_t; type rpm_script_t; type unconfined_t; type var_lock_t; type pppd_lock_t; } type_transition rpm_t var_lock_t : dir pppd_lock_t "ppp"; type_transition rpm_script_t var_lock_t : dir pppd_lock_t "ppp"; type_transition unconfined_t var_lock_t : dir pppd_lock_t "ppp"; #
Reassigning to selinux-policy per comment 3.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763