Bug 1915825 - Allow falling back to genfscon labeling when the FS doesn't support xattrs and there is a fs_use_xattr rule for it
Summary: Allow falling back to genfscon labeling when the FS doesn't support xattrs an...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: kernel
Version: 8.3
Hardware: All
OS: Linux
high
medium
Target Milestone: rc
: ---
Assignee: Ondrej Mosnacek
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On: 1934093
Blocks: 1899703
TreeView+ depends on / blocked
 
Reported: 2021-01-13 13:49 UTC by Ondrej Mosnacek
Modified: 2021-11-10 03:04 UTC (History)
2 users (show)

Fixed In Version: kernel-4.18.0-308.el8
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-09 19:01:22 UTC
Type: Enhancement
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Gitlab redhat/rhel/src/kernel rhel-8 merge_requests 437 0 None None None 2021-04-27 13:53:05 UTC
Red Hat Product Errata RHSA-2021:4356 0 None None None 2021-11-09 19:01:55 UTC

Description Ondrej Mosnacek 2021-01-13 13:49:16 UTC
Description of problem:

In order for the fix for BZ 1899703 to not break virtiofs mounts where the underlying filesystem (and thus the virtiofs mount itself) doesn't support xattrs, an additional kernel patch is needed that makes SELinux to fall back to a genfscon rule (if any) when there is an fs_use_xattr rule, but the superblock doesn't have xattr support.

The patch is currently posted at:
https://lore.kernel.org/selinux/20210113123802.63563-1-omosnace@redhat.com/T/

The patch's log message contains a simple reproducer that can be used to verify that the fallback works.

Comment 14 errata-xmlrpc 2021-11-09 19:01:22 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: kernel security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:4356


Note You need to log in before you can comment on or make changes to this bug.