2082080 – Fapolicyd unable to parse file with non-ascii characters in their name.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2082080 - Fapolicyd unable to parse file with non-ascii characters in their name.

Summary: Fapolicyd unable to parse file with non-ascii characters in their name.

Keywords:
Status:	CLOSED CURRENTRELEASE
Alias:	None
Product:	Red Hat Enterprise Linux 8
Classification:	Red Hat
Component:	fapolicyd
Sub Component:
Version:	8.5
Hardware:	All
OS:	Linux
Priority:	unspecified
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Radovan Sroka
QA Contact:	BaseOS QE Security Team
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2022-05-05 11:20 UTC by Ameya Patil
Modified:	2023-06-16 09:10 UTC (History)
CC List:	0 users
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:	2023-06-16 09:10:40 UTC
Type:	Bug
Target Upstream Version:
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Issue Tracker	RHELPLAN-121137	0	None	None	None	2022-05-05 11:28:11 UTC
Red Hat Issue Tracker	SECENGSP-4517	0	None	None	None	2022-05-05 11:28:13 UTC

Description Ameya Patil 2022-05-05 11:20:04 UTC

Description of problem:

Fapolicyd is not able to parse file name containing non-ascii characters , due to which the service enter fails state on reload or restart.
Also adding and deletion of file to the whitelist does now works till the offending file entry is removed from file /etc/fapolicyd/fapolicyd.trust


Version-Release number of selected component (if applicable):
~~~
# rpm -qa | grep fapolicy
fapolicyd-selinux-1.0.2-6.el8.noarch
fapolicyd-1.0.2-6.el8.x86_64
rpm-plugin-fapolicyd-4.14.3-19.el8_5.2.x86_64
~~~

How reproducible:
Everytime

Steps to Reproduce:

1. Create a test file with a Special characters.
~~~
# touch test$'\040\342\200\223\040'1.jpg               # Character is legal UTF-8 U+2013 EN DASH # UTF-8 Encoding: 0xE2 0x80 0x93

# ls -l 
total 0
-rw-r--r--. 1 root root 0 May  5 06:49 'test – 1.jpg'
~~~

2. Add the file to the fapolicyd database and update the fapolicyd daemon. We notice the error for cant parse the file.
~~~
# fapolicyd-cli --file add /test


[root@rhel8 test]# fapolicyd-cli --update
Fapolicyd was notified
[root@rhel8 test]# systemctl status fapolicyd
● fapolicyd.service - File Access Policy Daemon
   Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2022-05-05 06:51:55 EDT; 19s ago
  Process: 11091 ExecStart=/usr/sbin/fapolicyd (code=exited, status=0/SUCCESS)
 Main PID: 11092 (fapolicyd)
    Tasks: 4 (limit: 23286)
   Memory: 124.0M
   CGroup: /system.slice/fapolicyd.service
           └─11092 /usr/sbin/fapolicyd

May 05 06:51:57 rhel8.test.example.local fapolicyd[11092]: Loading data from file backend
May 05 06:51:57 rhel8.test.example.local fapolicyd[11092]: Starting to listen for events
May 05 06:52:11 rhel8.test.example.local fapolicyd[11092]: It looks like there was an update of the system... Syncing DB.
May 05 06:52:11 rhel8.test.example.local fapolicyd[11092]: Loading rpmdb backend
May 05 06:52:13 rhel8.test.example.local fapolicyd[11092]: Can't parse /test/test – 1.jpg 0 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
May 05 06:52:13 rhel8.test.example.local fapolicyd[11092]: Updating database
May 05 06:52:13 rhel8.test.example.local fapolicyd[11092]: Creating database
May 05 06:52:13 rhel8.test.example.local fapolicyd[11092]: Loading data from rpmdb backend
May 05 06:52:13 rhel8.test.example.local fapolicyd[11092]: Loading data from file backend
May 05 06:52:13 rhel8.test.example.local fapolicyd[11092]: Updated
~~~


3. Consequtive restart of fapolicyd or attempt to remove it using "--file delete" fails with same errors.
~~~
[root@rhel8 test]# systemctl restart fapolicyd
[root@rhel8 test]# systemctl status fapolicyd
● fapolicyd.service - File Access Policy Daemon
   Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Thu 2022-05-05 06:59:36 EDT; 3s ago
  Process: 21381 ExecStart=/usr/sbin/fapolicyd (code=exited, status=0/SUCCESS)
 Main PID: 21382 (code=exited, status=1/FAILURE)

May 05 06:59:35 rhel8.test.example.local systemd[1]: fapolicyd.service: Changed start -> running
May 05 06:59:35 rhel8.test.example.local systemd[1]: fapolicyd.service: Job fapolicyd.service/start finished, result=done
May 05 06:59:35 rhel8.test.example.local systemd[1]: Started File Access Policy Daemon.
May 05 06:59:36 rhel8.test.example.local fapolicyd[21382]: Can't parse /test/test – 1.jpg 0 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
May 05 06:59:36 rhel8.test.example.local fapolicyd[21382]: Failed to load data from backend (1)
May 05 06:59:36 rhel8.test.example.local systemd[1]: fapolicyd.service: Child 21382 belongs to fapolicyd.service.
May 05 06:59:36 rhel8.test.example.local systemd[1]: fapolicyd.service: Main process exited, code=exited, status=1/FAILURE
May 05 06:59:36 rhel8.test.example.local systemd[1]: fapolicyd.service: Failed with result 'exit-code'.
May 05 06:59:36 rhel8.test.example.local systemd[1]: fapolicyd.service: Changed running -> failed
May 05 06:59:36 rhel8.test.example.local systemd[1]: fapolicyd.service: Unit entered failed state.


# fapolicyd-cli --file delete /test
Can't parse /test/test – 1.jpg 0 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
~~~

4. Our option is to delete the entry manually form the file /etc/fapolicyd/fapolicyd.trust after which the service is started.
~~~
#  tail -n 1 /etc/fapolicyd/fapolicyd.trust
/test/test – 1.jpg 0 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

# sed -i.bak '/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855/d' /etc/fapolicyd/fapolicyd.trust

# systemctl restart fapolicyd
[root@rhel8 test]# systemctl status fapolicyd
● fapolicyd.service - File Access Policy Daemon
   Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; disabled; vendor preset: disabled)
   Active: active (running) since Thu 2022-05-05 07:05:27 EDT; 1s ago
  Process: 28852 ExecStart=/usr/sbin/fapolicyd (code=exited, status=0/SUCCESS)
 Main PID: 28853 (fapolicyd)
    Tasks: 1 (limit: 23286)
   Memory: 41.0M
   CGroup: /system.slice/fapolicyd.service
           └─28853 /usr/sbin/fapolicyd

May 05 07:05:27 rhel8.test.example.local systemd[1]: fapolicyd.service: Child 28852 belongs to fapolicyd.service.
May 05 07:05:27 rhel8.test.example.local fapolicyd[28853]: fapolicyd integrity is 0
May 05 07:05:27 rhel8.test.example.local systemd[1]: fapolicyd.service: Control process exited, code=exited status=0
May 05 07:05:27 rhel8.test.example.local fapolicyd[28853]: Loading rpmdb backend
May 05 07:05:27 rhel8.test.example.local systemd[1]: fapolicyd.service: Got final SIGCHLD for state start.
May 05 07:05:27 rhel8.test.example.local systemd[1]: fapolicyd.service: New main PID 28853 belongs to service, we are happy.
May 05 07:05:27 rhel8.test.example.local systemd[1]: fapolicyd.service: Main PID loaded: 28853
May 05 07:05:27 rhel8.test.example.local systemd[1]: fapolicyd.service: Changed start -> running
May 05 07:05:27 rhel8.test.example.local systemd[1]: fapolicyd.service: Job fapolicyd.service/start finished, result=done
May 05 07:05:27 rhel8.test.example.local systemd[1]: Started File Access Policy Daemon.
~~~


Actual results:
Fapolicyd fails to process file with non-ascii characters.


Expected results:
Fapolicyd should be able to process file with UTF-8 characters.


Additional info:

Note You need to log in before you can comment on or make changes to this bug.