Bug 2130899 - restorecon: Could not set context: No such file or directory
Summary: restorecon: Could not set context: No such file or directory
Keywords:
Status: NEW
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: policycoreutils
Version: 9.0
Hardware: All
OS: Linux
low
medium
Target Milestone: rc
: ---
Assignee: Petr Lautrbach
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-09-29 11:32 UTC by Jiri Jaburek
Modified: 2023-04-15 10:51 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-135294 0 None None None 2022-09-29 11:40:51 UTC

Description Jiri Jaburek 2022-09-29 11:32:51 UTC
Description of problem:

While running a recursive restorecon, I found that it can fail with

$ restorecon -nvvR /
restorecon: Could not set context for /boot/grub2/grubenvl355DR:  No such file or directory

This is likely because of a well-known "readdir vs read" race condition, where a program does readdir() first, and then goes over the resulting list of files, performing some operation on them.
If one of the files gets deleted while that traversal is happening (such as by being a temporary file), the program would get ENOENT.


Version-Release number of selected component (if applicable):
policycoreutils-3.3-6.el9_0.x86_64


How reproducible:
rarely on a real system
always using the reproducer below, within ~10 seconds


Steps to Reproduce:
0. Have (preferably) multicore (SMP) hardware
1. Open up two terminals
2. In one, run a loop of always-creating files with a wrong context, ie.
   - mkdir foo; cd foo
   - while :; do touch a b c; chcon -t etc_t a b c; rm -f a b c; done
3. In the other terminal, run restorecon attempting to correct them, ie.
   - while restorecon -Rvvn foo/; do :; done


Actual results:
restorecon sometimes fails on a filesystem using temporary files


Expected results:
restorecon silently ignores ENOENT for files that were seen in readdir()


Note You need to log in before you can comment on or make changes to this bug.