Brian,

What is the reason having the file labeled as httpd_sys_rw_content_t? Type of the file on the default location is

rhel88# matchpathcon /usr/libexec/kf5/kitinerary-extractor
/usr/libexec/kf5/kitinerary-extractor   system_u:object_r:bin_t:s0

and httpd is allowed to execute it:

rhel88# sesearch -A -s httpd_t -t bin_t -c file -p execute
allow httpd_t base_ro_file_type:file { execute execute_no_trans getattr ioctl lock map open read };
allow httpd_t bin_t:file { execute execute_no_trans getattr ioctl lock map open read };


Other than that, you are right, the boolean seems to be quite powerful and not quite well documented:

rhel88# semanage boolean -l | grep -e ^SELinux -e httpd_unified
SELinux boolean                State  Default Description
httpd_unified                  (off  ,  off)  Unify HTTPD handling of all content files.

It also needs to be troubleshooted why the man page does not mention all httpd booleans.

(In reply to Zdenek Pytela from comment #1)
> Brian,

Hi Zdenek,
 
> What is the reason having the file labeled as httpd_sys_rw_content_t?

I have no reason in particular for that.  Isn't that just the default label for that location?

> Type
> of the file on the default location is
> 
> rhel88# matchpathcon /usr/libexec/kf5/kitinerary-extractor
> /usr/libexec/kf5/kitinerary-extractor   system_u:object_r:bin_t:s0

Which seems quite reasonable.

But do note that the path of this particular kitinerary-extractor is /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin/bin/ as it's bundled (as much as I hate bundling) with nextcloud.

I am aware that kf5-kitinerary-0:22.04.1-1.el8.x86_64 exists in EL8 but I really don't know enough about nextcloud apps to know how/if I can use the above RPM and remove it from the Nextcloud app.  That's probably not even possible.

Perhaps SELinux needs some policy to handle binaries bundled with nextcloud [apps]?  I currently have the following 'bin' directories in /var/lib/nextcloud:

/var/lib/nextcloud/apps/mail/vendor/cerdic/css-tidy/bin
/var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin/bin
/var/lib/nextcloud/apps/mail/vendor/amphp/process/bin

Looks like this is the default:

rhel88# matchpathcon /var/lib/nextcloud
/var/lib/nextcloud      system_u:object_r:httpd_sys_rw_content_t:s0

Unfortunately I am not aware of the package tree content, but I'd expect an equivalency rule, e. g.

rhel88# semanage fcontext -a -e /usr/bin /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin
rhel88# restorecon -Rv /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin

is set to assign proper context to files in the directory provided they should be executed from httpd as if they were on the regular path. It needs to be assessed case by case.

Having said that, I don't think there is anything which could be addressed in selinux-policy, but rather in the app or as a local policy at the target system.

(In reply to Zdenek Pytela from comment #3)
> 
> Unfortunately I am not aware of the package tree content,

I provided a few examples in my previous message.  It seems pattern/predictable.

> but I'd expect an
> equivalency rule, e. g.
> 
> rhel88# semanage fcontext -a -e /usr/bin
> /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin

Can this be applied as a wildcard with '*/*' or somesuch in place of the 'christophwurst/kitinerary-bin' since all 3 examples found match that pattern?

> Having said that, I don't think there is anything which could be addressed
> in selinux-policy, but rather in the app

I'm afraid I don't know anything about how to distribute selinux policy updates with app RPMs.  :-(

> or as a local policy at the target
> system.

Yeah, of course.  But then every sysadmin has to [know [how to]] do this.  :-( also.

(In reply to Brian J. Murrell from comment #4)
> (In reply to Zdenek Pytela from comment #3)
> > 
> > Unfortunately I am not aware of the package tree content,
> 
> I provided a few examples in my previous message.  It seems
> pattern/predictable.
> 
> > but I'd expect an
> > equivalency rule, e. g.
> > 
> > rhel88# semanage fcontext -a -e /usr/bin
> > /var/lib/nextcloud/apps/mail/vendor/christophwurst/kitinerary-bin
> 
> Can this be applied as a wildcard with '*/*' or somesuch in place of the
> 'christophwurst/kitinerary-bin' since all 3 examples found match that
> pattern?

I also provided just an example.
Regular expressions (not wildcards) can be used in the semanage-fcontext command file specification.
The actual content of the setting needs to be assessed by someone understanding the content and usage, perhaps making an equivalency of the content root (or all content root patterns) to filesystem root.
Software collections may serve as a good example of equivalency rules when the software is installed into /opt.

> > Having said that, I don't think there is anything which could be addressed
> > in selinux-policy, but rather in the app
> 
> I'm afraid I don't know anything about how to distribute selinux policy
> updates with app RPMs.  :-(
> 
> > or as a local policy at the target
> > system.
> 
> Yeah, of course.  But then every sysadmin has to [know [how to]] do this. 
> :-( also.

I think the package vendor should be contacted.

(In reply to Zdenek Pytela from comment #5)
> I also provided just an example.
> Regular expressions (not wildcards) can be used in the semanage-fcontext
> command file specification.

Ahhh.  That's useful to know.  Thanks!

> I think the package vendor should be contacted.

Meaning the nextcloud developers or the person rolling it into an RPM?  If the latter, that is me, based on work done by others.

(In reply to Brian J. Murrell from comment #6)
> (In reply to Zdenek Pytela from comment #5)
> > I also provided just an example.
> > Regular expressions (not wildcards) can be used in the semanage-fcontext
> > command file specification.
> 
> Ahhh.  That's useful to know.  Thanks!
> 
> > I think the package vendor should be contacted.
> 
> Meaning the nextcloud developers or the person rolling it into an RPM?  If
> the latter, that is me, based on work done by others.

In that case it should not be difficult to include a particular semanage-fcontext command for each subpackage, see

semanage fcontext -a -e / "/var/lib/nextcloud/apps/mail/vendor/c/cc"
mkdir -p /var/lib/nextcloud/apps/mail/vendor/c/cc/usr/bin
touch /var/lib/nextcloud/apps/mail/vendor/c/cc/usr/bin/ls
restorecon -Rv  /var/lib/nextcloud/apps/mail/vendor
Relabeled /var/lib/nextcloud/apps/mail/vendor/c/cc from unconfined_u:object_r:httpd_sys_rw_content_t:s0 to unconfined_u:object_r:root_t:s0
Relabeled /var/lib/nextcloud/apps/mail/vendor/c/cc/usr from unconfined_u:object_r:httpd_sys_rw_content_t:s0 to unconfined_u:object_r:usr_t:s0
Relabeled /var/lib/nextcloud/apps/mail/vendor/c/cc/usr/bin from unconfined_u:object_r:httpd_sys_rw_content_t:s0 to unconfined_u:object_r:bin_t:s0
Relabeled /var/lib/nextcloud/apps/mail/vendor/c/cc/usr/bin/ls from unconfined_u:object_r:httpd_sys_rw_content_t:s0 to unconfined_u:object_r:bin_t:s0

but the actual usage needs to be adjusted based on the subpackage content.

As no new information appeared during the past weeks, we are going to close this bug. If you need to pursue this matter further, feel free to reopen this bug and attach the needed information.