Bug 1731501 - [RFE] add possibility to check sum of loaded module
Summary: [RFE] add possibility to check sum of loaded module
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: policycoreutils
Version: 8.4
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Petr Lautrbach
QA Contact: Milos Malik
Jan Fiala
Depends On:
TreeView+ depends on / blocked
Reported: 2019-07-19 14:41 UTC by Filip Krska
Modified: 2022-05-10 16:44 UTC (History)
11 users (show)

Fixed In Version: policycoreutils-2.9-17.el8
Doc Type: Enhancement
Doc Text:
.New option to verify SELinux module checksums With the newly added `--checksum` option to the `semodule` command, you can verify the versions of installed SELinux policy modules. Because Common Intermediate Language (CIL) does not store module name and module version in the module itself, there previously was no simple way to verify that the installed module is the same version as the module which was supposed to be installed. With the new command `semodule -l --checksum`, you receive a SHA256 hash of the specified module and can compare it with the checksum of the original file, which is faster than reinstalling modules. Example of use: ---- # semodule -l --checksum | grep localmodule localmodule sha256:db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd # /usr/libexec/selinux/hll/pp localmodule.pp | sha256sum db002f64ddfa3983257b42b54da7b182c9b2e476f47880ae3494f9099e1a42bd - ----
Clone Of:
Last Closed: 2022-05-10 15:25:47 UTC
Type: Bug
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2022:2068 0 None None None 2022-05-10 15:25:57 UTC

Description Filip Krska 2019-07-19 14:41:05 UTC
Description of problem:

1. Proposed title of this feature request

[RFE] add possibility to check sum of loaded module

2. Who is the customer behind the request?

Account: RED HAT IT/IS 5243891
TAM customer: yes
CSM customer: yes
Strategic: yes

3. What is the nature and description of the request?

Use case:

Ansible loads a module. If I then need to make changes to 
this policy in the future, how can Ansible compare the .pp file in 
config management with the state loaded on the system?

Need some mechanism to compare loaded module with definition of the module we expect to be running.

4. Why does the customer need this? (List the business requirements here)

Having Ansible reload the module every run will cause problems in real operations.

5. How would the customer like to achieve this? (List the functional requirements here)

Introduce st like `semodule -l --checksum` that could be compared with the module definition.

6. For each functional requirement listed, specify how Red Hat and the customer can test to confirm the requirement is successfully implemented.

7. Is there already an existing RFE upstream or in Red Hat Bugzilla?


8. Does the customer have any specific timeline dependencies and which release would they like to target (i.e. RHEL5, RHEL6)?

9. Is the sales team involved in this request and do they have any additional input?

10. List any affected packages or components.

11. Would the customer be able to assist in testing this functionality if implemented?


Comment 32 errata-xmlrpc 2022-05-10 15:25:47 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (policycoreutils bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.