Bug 1559808

Description of problem:

When having local customizations and /etc/selinux/fixfiles_exclude_dirs containing a path, relabelling the filesystems using "fixfiles -F restore" or "touch /.autorelabel && reboot" leads to the customized contexts to not be applied.

After relabelling, a restorecon needs to be issued to restore the customizations.


Version-Release number of selected component (if applicable):

policycoreutils-2.5-17.1.el7.x86_64


How reproducible:

Always


Steps to Reproduce:
1. Create a dummy file and customized context

  # touch /usr/local/bin/dummy
  # semanage fcontext -a -t shell_exec_t /usr/local/bin/dummy
  # restorecon -F /usr/local/bin/dummy
  # ls -Z /usr/local/bin/dummy
  -rw-r--r--. root root system_u:object_r:shell_exec_t:s0 /usr/local/bin/dummy

2. Add a existing directory to /etc/selinux/fixfiles_exclude_dirs

  # mkdir /mydir
  # echo "/mydir" > /etc/selinux/fixfiles_exclude_dirs

3. Run "fixfiles -F restore" (this is what is done when touching /.autorelabel and rebooting)

  # fixfiles -F restore

4. Verify context

  # ls -Z /usr/local/bin/dummy


Actual results: (bin_t)

  -rw-r--r--. root root system_u:object_r:bin_t:s0       /usr/local/bin/dummy


Expected results: (shell_exec_t)

  -rw-r--r--. root root system_u:object_r:shell_exec_t:s0 /usr/local/bin/dummy


Additional info:

Running fixfiles with tracing (set -x; set -o functrace), we can see that the contexts file passed to "setfiles" is different (it is some "temporary" file used when exclucing a directory, and not the standard file):

/tmp/fixfiles.ko:+ SETFILES=/sbin/setfiles
/tmp/fixfiles.ko:+ /sbin/setfiles -e /mydir -q -F /etc/selinux/targeted/contexts/files/file_contexts.RTPjVxc8cB / /boot /dev /dev/hugepages /dev/mqueue /dev/pts /dev/shm /run 

/tmp/fixfiles.ok:+ SETFILES=/sbin/setfiles
/tmp/fixfiles.ok:+ /sbin/setfiles -q -F /etc/selinux/targeted/contexts/files/file_contexts / /boot /dev /dev/hugepages /dev/mqueue /dev/pts /dev/shm /run /run/user/0 /sys /usr