Hide Forgot
Description of problem: Some selinux types and attributes were changed during the installation to image. Version-Release number of selected component (if applicable): RHEL-8.6.0-20220201.1 anaconda-33.16.6.5-1.el8 How reproducible: Always Steps to Reproduce: 1. seinfo --all > seinfo_all_before.out 2. Create disk image `fallocate -l 9G /root/disk.img` 2. Start installation `anaconda --image=/root/disk.img --repo=<url>` 3. Perform minimal installation 3. seinfo --all > seinfo_all_after.out Actual results: Full seinfo diff, before and after installation to image: diff seinfo_all_before.out seinfo_all_after.out 7c7 < Types: 4946 Attributes: 252 --- > Types: 4943 Attributes: 254 10,12c10,12 < Allow: 110798 Neverallow: 0 < Auditallow: 163 Dontaudit: 10258 < Type_trans: 243938 Type_change: 87 --- > Allow: 110675 Neverallow: 0 > Auditallow: 161 Dontaudit: 10310 > Type_trans: 241546 Type_change: 87 2547c2547 < Types: 4946 --- > Types: 4943 3772,3773d3771 < flatpak_helper_exec_t < flatpak_helper_t 6142a6141 > sandbox_t 6631,6632d6629 < swtpm_exec_t < swtpm_t 7495c7492 < Type Attributes: 252 --- > Type Attributes: 254 7656a7654 > sandbox_domain 7658a7657 > sandbox_typeattr_1 Expected results: No changes on the "host" system. Additional info: It seems that the differences depend on what environment you have and what you are installing to the image.
Hi Vlada, could you please take a look on this if it is SELinux or us?
I did not find anything that would explicitly change such things, so I think this effect is indirect and likely not our bug. In my limited understanding, a system's policy can consist of many files installed by many packages, and this command's output only dumps the sum of all the types from all the files. With that hypothesis, the differences in seinfo output according to installed packages make sense. And changes to the output on host instead of target feel like something is leaking while installing things. It might be useful to see if the same changes occur to installation environment. Better ask somebody who knows what they are doing...