Hi,

It appears that the issue is wider: IMHO there is a design issue here.

A customer noticed a similar problem with creating a directory "/var/lib/foo/debug", which ends up get a non-sense ldconfig_cache_t context on that directory.

Reproducer:
~~~
# mkdir -p /var/lib/foo/debug
# ls -Zd /var/lib/foo/debug
unconfined_u:object_r:ldconfig_cache_t:s0 /var/lib/foo/debug
~~~

Reason: this happens because of the following transition rule:
~~~
# sesearch -T -s unconfined_t -t var_lib_t | grep debug
type_transition unconfined_t var_lib_t:dir ldconfig_cache_t debug;
~~~

The above rule states that:
  if the processed in unconfined_t (e.g. bash for unconfined users)
AND
  the process creates a directory named debug for which parent directory is labeled with var_lib_t
THEN
  it gets the context ldconfig_cache_t

This is pure non-sense.


First, with current fcontext database, there is nothing that expects "debug" directories to be labeled with ldconfig_cache_t:
~~~
# semanage fcontext -l | grep ldconfig_cache_t
/var/cache/ldconfig(/.*)?                          all files          system_u:object_r:ldconfig_cache_t:s0 
~~~

Then, even if we fix this particular example, I would prefer a **real** solution be proposed.

To solve this kind of oddity, we need an additional property in the transition rule that would let us specify the parent directory name the rule should apply on.

Once this is implemented, it would then be possible to generate transition rules for files based on the content of the fcontext database, which would then guarantee everything remains in sync.

Renaud.

Hi Renaud,

boot.log is labeled as plymouthd_var_log_t, because we have file transition for specific rule in policy. This file transition is here because otherwise the file created in /var/log would get into conflict due that this file is create by unconfined_t domain. So we need to specify object to get him proper label.

As you can see bellow, here is a lot of named filetrans from unconfined_t domain.

sesearch -T -s unconfined_t -t var_log_t

type_transition unconfined_t var_log_t:dir snapperd_data_t .snapshots;
type_transition unconfined_t var_log_t:dir sssd_var_log_t sssd;
type_transition unconfined_t var_log_t:dir var_log_t anaconda;
type_transition unconfined_t var_log_t:dir var_log_t remote;
type_transition unconfined_t var_log_t:file NetworkManager_var_lib_t wpa_supplicant.log;
type_transition unconfined_t var_log_t:file devicekit_var_log_t pm-powersave.log;
type_transition unconfined_t var_log_t:file devicekit_var_log_t pm-suspend.log;
type_transition unconfined_t var_log_t:file faillog_t btmp;
type_transition unconfined_t var_log_t:file faillog_t faillog;
type_transition unconfined_t var_log_t:file faillog_t tallylog;
type_transition unconfined_t var_log_t:file lastlog_t lastlog;
type_transition unconfined_t var_log_t:file plymouthd_var_log_t boot.log;
type_transition unconfined_t var_log_t:file rpm_log_t hawkey.log;
type_transition unconfined_t var_log_t:file rpm_log_t up2date;
type_transition unconfined_t var_log_t:file rpm_log_t yum.log;
type_transition unconfined_t var_log_t:file wtmp_t wtmp;


Second reason is, that /var/log isn't only one place where can be placed boot.log file, also in /var/spool/plymouth can be placed, so wee need filetrans which specify object.

It's unfortunate that a generic name like boot.log or debug is used by other services, but that's how the developers of those services came up with it. The solution would be for the developers to name these files with a less generic name.

Regards,
Patrik

Hi Patrik,

I disagree with this, the label for boot.log should only be applied for process "plymouthd" (running as "plymouthd_t"), not the other processes, it's not reasonable.
For example "semanage", running as "semanage_t", will also have an hypothetical "boot.log" file labeled with "plymouthd_var_log_t", that's total non-sense.

The same for "debug" directory that gets the label "ldconfig_cache_t", it's non-sense. Since for the latter ldconfig can run in any domain, then "ldconfig" should **rename** it's directory as something specific, such as "ldconfig_debug", **or** have a subdirectory created such as "ldconfig", which would be labeled differently (e.g. "var_ldconfig_t") and creating a "debug" directory inside the latter would transition to "ldconfig_cache_t", but only i n this case.

Please reconsider.

Renaud.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4420