Bug 2039974
| Summary: | restorecon would relabel /run/stratisd | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Jiri Jaburek <jjaburek> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 9.0 | CC: | lvrabec, mmalik, ssekidde |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | 9.0 | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-34.1.23-1.el9 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-17 15:50:10 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Jiri Jaburek
2022-01-12 20:02:22 UTC
Looks stratisd changed runtime files to a directory, this is the current state: /var/run/stratisd.* -- gen_context(system_u:object_r:stratisd_var_run_t,s0) Similar problem is reproducible on RHEL-8. For more information please read https://bugzilla.redhat.com/show_bug.cgi?id=1879585#c7 I've submitted a draft Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy/pull/1025 This has started appearing recently again, but with a different context, # dnf install stratisd # systemctl start stratisd # restorecon -nvvR /run Would relabel /run/stratisd/keyfiles from system_u:object_r:tmpfs_t:s0 to system_u:object_r:stratisd_var_run_t:s0 I'm not sure if the finding is a result of this BZ or if it's unrelated, though. # rpm -q selinux-policy selinux-policy-34.1.24-1.el9.noarch An auditctl watch on /run/stratisd shows: ---- type=PROCTITLE msg=audit(02/10/2022 21:42:42.357:126) : proctitle=/usr/libexec/stratisd --log-level debug type=PATH msg=audit(02/10/2022 21:42:42.357:126) : item=1 name=/run/stratisd inode=989 dev=00:19 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:stratisd_var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/10/2022 21:42:42.357:126) : item=0 name=/run/ inode=1 dev=00:19 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/10/2022 21:42:42.357:126) : cwd=/ type=SYSCALL msg=audit(02/10/2022 21:42:42.357:126) : arch=x86_64 syscall=mkdir success=yes exit=0 a0=0x55b95dbc1250 a1=0777 a2=0xe a3=0x6 items=2 ppid=1 pid=865 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=stratisd exe=/usr/libexec/stratisd subj=system_u:system_r:stratisd_t:s0 key=foobar ---- type=PROCTITLE msg=audit(02/10/2022 21:42:42.357:127) : proctitle=/usr/libexec/stratisd --log-level debug type=PATH msg=audit(02/10/2022 21:42:42.357:127) : item=1 name=/run/stratisd/keyfiles inode=990 dev=00:19 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:stratisd_var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/10/2022 21:42:42.357:127) : item=0 name=/run/stratisd/ inode=989 dev=00:19 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:stratisd_var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/10/2022 21:42:42.357:127) : cwd=/ type=SYSCALL msg=audit(02/10/2022 21:42:42.357:127) : arch=x86_64 syscall=mkdir success=yes exit=0 a0=0x55b95dbc1250 a1=0777 a2=0x17 a3=0x6 items=2 ppid=1 pid=865 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=stratisd exe=/usr/libexec/stratisd subj=system_u:system_r:stratisd_t:s0 key=foobar Here is an excerpt from the https://bugzilla.redhat.com/show_bug.cgi?id=1879585#c7: * Under /run/stratisd/keyfiles, stratisd will mount other filesystems in a private mount namespace. I'm not entirely sure how this will interact with SELinux. I'm not sure if SELinux can do much more in this situation, unless stratisd explicitly calls the restorecon command or a similar tool. The location and all objects under it are already covered: # semanage fcontext -l | grep /run/stratis /var/run/stratisd(/.*)? all files system_u:object_r:stratisd_var_run_t:s0 /var/run/stratisd.* regular file system_u:object_r:stratisd_var_run_t:s0 # In the current policy version I see: rhel9# sesearch -T -s stratisd_t -t var_run_t -c dir ... type_transition stratisd_t var_run_t:dir stratisd_var_run_t; that is stratisd running in the stratisd_t domain creates directories in /var/run with the type transitioning to stratisd_var_run_t - so I don't understand why /run/stratisd/keyfiles would have tmpfs_t, and I infer from your command /run/stratisd is correct. I am not quite sure what happens next though when the mounts in the private mount namespace take place. selinux-policy-34.1.24-1.el9.noarch is currently the latest version which should include all necessary rules. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (new packages: selinux-policy), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:3918 |