Bug 1657394
| Summary: | rpm creates new files as unconfined_u instead of system_u | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Chris Cheney <ccheney> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED NOTABUG | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.6 | CC: | lvrabec, mgrepl, mmalik, plautrba, riehecky, ssekidde, vmojzis, yoguma, zpytela |
| Target Milestone: | rc | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-04-26 07:43:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Chris Cheney
2018-12-07 21:24:43 UTC
These are unowned files that are created when running update-mime-database from %post, rpm is not involved in their creation or context setting. Note that restorecon doesn't do anything about the unconfined_u either, so if it's supposed to be something else then it seems like a selinux-policy issue to me: [root@zoo ~]# ls -lZ /usr/share/mime/types -rw-r--r--. root root unconfined_u:object_r:usr_t:s0 /usr/share/mime/types [root@zoo ~]# restorecon -v /usr/share/mime/types [root@zoo ~]# ls -lZ /usr/share/mime/types -rw-r--r--. root root unconfined_u:object_r:usr_t:s0 /usr/share/mime/types This issue was not selected to be included in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small number of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available. We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable. Hi,
If file is created by a process running in unconfined_t domain like a login shell:
# id
uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
the user part of the context of the file is also unconfined_u. To restore all the parts of the context, restorecon with the -F switch should be run - see restorecon(8):
-F Force reset of context to match file_context for customizable files, and the
default file context, changing the user, role, range portion as well as the
type.
# ls -lZ /usr/share/mime/icons
-rw-r--r--. root root system_u:object_r:usr_t:s0 /usr/share/mime/iconsicons
# yum reinstall shared-mime-info
...
# ls -lZ /usr/share/mime/icons
-rw-r--r--. root root unconfined_u:object_r:usr_t:s0 /usr/share/mime/icon
# restorecon -FRv /usr/share/mime
...
# ls -lZ /usr/share/mime/icons
-rw-r--r--. root root system_u:object_r:usr_t:s0 /usr/share/mime/icons
Could you please elaborate on what exactly is the security concern?
Based on the latest development, closing as NOTABUG. Feel free to reopen the bugzilla or create a new one if the issue persists. |