Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1610676

Summary:	valgrind binary has wrong selinux context
Product:	Red Hat Developer Toolset	Reporter:	Miloš Prchlík <mprchlik>
Component:	valgrind	Assignee:	Mark Wielaard <mjw>
Status:	CLOSED ERRATA	QA Contact:	Alexandra Petlanová Hájková <ahajkova>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	DTS 8.0 RHEL 6	CC:	ahajkova, jakub, kanderso, mcermak, mnewsome, mpolacek, ohudlick
Target Milestone:	alpha
Target Release:	8.0
Hardware:	x86_64
OS:	Unspecified
Whiteboard:
Fixed In Version:	devtoolset-8-valgrind-3.13.0-26	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-11-13 08:39:06 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Miloš Prchlík 2018-08-01 08:01:32 UTC

Description of problem:

In previous DTS releases for RHEL6, valgrind binary has this selinux context:

-rwxr-xr-x. root root system_u:object_r:execmem_exec_t:s0 /opt/rh/devtoolset-7/root/usr/bin/valgrind

This has changed in DTS8:

-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /opt/rh/devtoolset-8/root/usr/bin/valgrind


Version-Release number of selected component (if applicable):

devtoolset-8-valgrind-3.13.0-20.el6.x86_64


How reproducible:


Steps to Reproduce:
1. ls -Z /opt/rh/devtoolset-8/root/usr/bin/valgrind 
2.
3.

Actual results:


Expected results:


Additional info:

Comment 2 Mark Wielaard 2018-08-01 09:12:17 UTC

That is strange. The devtoolset-8-runtime package is responsible for setting up the selinux equivelance between / and /opt/rh/devtoolset-8/root

%post runtime
if [ ! -f %{_sysconfdir}/selinux-equiv.created ]; then
  /usr/sbin/semanage fcontext -a -e / %{_scl_root}
  restorecon -R %{_scl_root}
  touch %{_sysconfdir}/selinux-equiv.created
fi

That should make it so... O, wait I see. On RHEL6 we used to have the following in valgrind.spec:

# We need to fixup selinux file context when doing a scl build.
# In RHEL6 we might need to fix up the labels even though the
# meta package sets up a fs equivalence. See post.
%if 0%{?rhel} == 6
%{?scl:Requires(post): /sbin/restorecon}
%endif

%if 0%{?rhel} == 6
%post
# There is a bug in rpm (rhbz#214737) that might cause post to be run
# even thought the binary isn't installed when installing two multilib
# versions at the same time.
if [ -x %{_bindir}/valgrind ]; then
# On RHEL6 the fs equivalency should be setup by the devtoolset meta
# package, but because of a rpm bug (rhbz#924044) it might not work.
%{?scl:/sbin/restorecon %{_bindir}/valgrind}%{!?scl:true}
fi
%endif

This part is gone in devtoolset-8.0-rhel-6 valgrind.spec.
I will restore it. Thanks for noticing.

Comment 6 errata-xmlrpc 2018-11-13 08:39:06 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3564