Description of problem: When I do not have selinux-policy-targeted installed and I still have "SELINUXTYPE=targeted" configured in /etc/selinux/config, restorecon will return hard-to-understand ENOENT error messages. Version-Release number of selected component (if applicable): policycoreutils-2.9-10.el8.x86_64 How reproducible: always Steps to Reproduce: 1. Uninstall selinux-policy-targeted and install selinux-policy-minimum 2. Ensure /etc/selinux/config has "SELINUXTYPE=targeted" (the WRONG policy) 3. touch /tmp/foo.txt 4. restorecon -v /tmp/foo.txt Actual results: restorecon fails with a mysterious error message "No such file or directory". Users are confused because /tmp/foo.txt does exist. Expected results: restorecon shows the user the exact path that corresponds to the fatal ENOENT error message. It's not /tmp/foo.txt, but it's something under /etc/selinux/targeted/. Additional info: We ran into this UX problem while troubleshooting https://bugzilla.redhat.com/show_bug.cgi?id=1923719
ENOENT is propagated from selabel_subs_init(): #0 selabel_subs_init (path=0x55555555bc60 "/etc/selinux/targeteda/contexts/files/file_contexts.subs_dist", digest=digest@entry=0x0, out_subs=out_subs@entry=0x55555555b378) at /usr/src/debug/libselinux-3.2-0.rc2.1.fc34.x86_64/src/label_file.c:612 #1 0x00007ffff7fa2924 in init (rec=0x55555555b2e0, opts=<optimized out>, n=<optimized out>) at /usr/src/debug/libselinux-3.2-0.rc2.1.fc34.x86_64/src/selinux_config.c:254 #2 0x00007ffff7fa252b in selabel_open (backend=0, opts=0x7fffffffe3d0, nopts=3) at /usr/src/debug/libselinux-3.2-0.rc2.1.fc34.x86_64/src/label.c:228 #3 0x0000555555556ac2 in restore_init (opts=0x55555555a0c0 <r_opts>) at /usr/src/debug/policycoreutils-3.2-0.rc2.1.fc34.x86_64/policycoreutils/setfiles/restore.c:30 #4 main (argc=3, argv=0x7fffffffe5c8) at /usr/src/debug/policycoreutils-3.2-0.rc2.1.fc34.x86_64/policycoreutils/setfiles/setfiles.c:428 But the error message is printed in restore_init(): opts->hnd = selabel_open(SELABEL_CTX_FILE, selinux_opts, 3); if (!opts->hnd) { perror(opts->selabel_opt_path); exit(1); }
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (policycoreutils bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:2068