1926511 – restorecon ENOENT policy error is unclear

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1926511 - restorecon ENOENT policy error is unclear

Summary: restorecon ENOENT policy error is unclear

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 8
Classification:	Red Hat
Component:	policycoreutils
Sub Component:
Version:	8.5
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	rc
Target Release:	8.0
Assignee:	Vit Mojzis
QA Contact:	Milos Malik
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2021-02-08 22:10 UTC by Ken Dreyer (Red Hat)
Modified:	2022-05-10 16:44 UTC (History)
CC List:	6 users (show)
Fixed In Version:	policycoreutils-2.9-18.el8
Doc Type:	No Doc Update
Doc Text:
Clone Of:
Clones:	2041975 (view as bug list)
Environment:
Last Closed:	2022-05-10 15:25:47 UTC
Type:	Bug
Target Upstream Version:
Embargoed:
Dependent Products:
Flags:	pm-rhel: mirror+

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2022:2068	0	None	None	None	2022-05-10 15:25:57 UTC

Description Ken Dreyer (Red Hat) 2021-02-08 22:10:20 UTC

Description of problem:
When I do not have selinux-policy-targeted installed and I still have "SELINUXTYPE=targeted" configured in /etc/selinux/config, restorecon will return hard-to-understand ENOENT error messages.

Version-Release number of selected component (if applicable):
policycoreutils-2.9-10.el8.x86_64

How reproducible:
always

Steps to Reproduce:
1. Uninstall selinux-policy-targeted and install selinux-policy-minimum
2. Ensure /etc/selinux/config has "SELINUXTYPE=targeted" (the WRONG policy)
3. touch /tmp/foo.txt
4. restorecon -v /tmp/foo.txt

Actual results:
restorecon fails with a mysterious error message "No such file or directory". Users are confused because /tmp/foo.txt does exist.

Expected results:
restorecon shows the user the exact path that corresponds to the fatal ENOENT error message. It's not /tmp/foo.txt, but it's something under /etc/selinux/targeted/.

Additional info:
We ran into this UX problem while troubleshooting https://bugzilla.redhat.com/show_bug.cgi?id=1923719

Comment 1 Petr Lautrbach 2021-03-03 12:42:53 UTC

ENOENT is propagated from selabel_subs_init():


#0  selabel_subs_init (path=0x55555555bc60 "/etc/selinux/targeteda/contexts/files/file_contexts.subs_dist", digest=digest@entry=0x0, 
    out_subs=out_subs@entry=0x55555555b378) at /usr/src/debug/libselinux-3.2-0.rc2.1.fc34.x86_64/src/label_file.c:612
#1  0x00007ffff7fa2924 in init (rec=0x55555555b2e0, opts=<optimized out>, n=<optimized out>)
    at /usr/src/debug/libselinux-3.2-0.rc2.1.fc34.x86_64/src/selinux_config.c:254
#2  0x00007ffff7fa252b in selabel_open (backend=0, opts=0x7fffffffe3d0, nopts=3) at /usr/src/debug/libselinux-3.2-0.rc2.1.fc34.x86_64/src/label.c:228
#3  0x0000555555556ac2 in restore_init (opts=0x55555555a0c0 <r_opts>)
    at /usr/src/debug/policycoreutils-3.2-0.rc2.1.fc34.x86_64/policycoreutils/setfiles/restore.c:30
#4  main (argc=3, argv=0x7fffffffe5c8) at /usr/src/debug/policycoreutils-3.2-0.rc2.1.fc34.x86_64/policycoreutils/setfiles/setfiles.c:428

But the error message is printed in restore_init():

	opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3);
	if (!opts->hnd) {
		perror(opts->selabel_opt_path);
		exit(1);
	}

Comment 17 errata-xmlrpc 2022-05-10 15:25:47 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (policycoreutils bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2068

Note You need to log in before you can comment on or make changes to this bug.