Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1530601 - SELinux filecontext for /var/lock/ppp is not set upon package installation
SELinux filecontext for /var/lock/ppp is not set upon package installation
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.4
All Linux
high Severity high
: rc
: ---
Assigned To: Lukas Vrabec
Milos Malik
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2018-01-03 08:09 EST by Renaud Métrich
Modified: 2018-04-10 08:48 EDT (History)
9 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-187.el7
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-04-10 08:47:26 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 3306081 None None None 2018-01-03 11:15 EST
Red Hat Product Errata RHBA-2018:0763 None None None 2018-04-10 08:48 EDT

  None (edit)
Description Renaud Métrich 2018-01-03 08:09:38 EST
Description of problem:

SELinux filecontext for /var/lock/ppp is not set upon package installation.
Package installs the directory with "unconfined_u:object_r:var_lock_t:s0" instead of "system_u:object_r:pppd_lock_t:s0".


Version-Release number of selected component (if applicable):

ppp-2.4.5-33.el7.x86_64


How reproducible:

ALWAYS


Steps to Reproduce:
1. Install the ppp package
Comment 3 Milos Malik 2018-01-15 07:14:21 EST
There is no type_transition rule in the policy that would ensure that /var/lock/ppp gets a correct context when it's created:

# sesearch -T | grep pppd_lock_t
#

If there was such a rule, the /var/lock/ppp directory would be labeled correctly by rpm/yum during the installation of ppp package.

# ls -dZ /var/lock/ppp
ls: cannot access /var/lock/ppp: No such file or directory
# yum -y install ppp
Loaded plugins: product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
Resolving Dependencies
--> Running transaction check
---> Package ppp.x86_64 0:2.4.5-33.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

================================================================================
 Package        Arch              Version                 Repository       Size
================================================================================
Installing:
 ppp            x86_64            2.4.5-33.el7            rhel            357 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 357 k
Installed size: 852 k
Downloading packages:
ppp-2.4.5-33.el7.x86_64.rpm                                | 357 kB   00:00     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : ppp-2.4.5-33.el7.x86_64                                      1/1 
  Verifying  : ppp-2.4.5-33.el7.x86_64                                      1/1 

Installed:
  ppp.x86_64 0:2.4.5-33.el7                                                     

Complete!
# ls -dZ /var/lock/ppp
drwxr-xr-x. root root unconfined_u:object_r:pppd_lock_t:s0 /var/lock/ppp
# 

Following policy module brings such a rule:

# cat mypolicy.te 
policy_module(mypolicy,1.0)

require {
  type rpm_t;
  type rpm_script_t;
  type unconfined_t;
  type var_lock_t;
  type pppd_lock_t;
}

type_transition rpm_t var_lock_t : dir pppd_lock_t "ppp"; 
type_transition rpm_script_t var_lock_t : dir pppd_lock_t "ppp"; 
type_transition unconfined_t var_lock_t : dir pppd_lock_t "ppp"; 
#
Comment 7 Jaroslav Škarvada 2018-01-30 05:29:20 EST
Reassigning to selinux-policy per comment 3.
Comment 16 errata-xmlrpc 2018-04-10 08:47:26 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0763

Note You need to log in before you can comment on or make changes to this bug.