Description of problem: While trying to package RIPE Atlas Probe/Anchor for Fedora and EPEL, I had to learn that SELinux labels RIPE Atlas Probe/Anchor's /usr/sbin/ripe-atlas process as zebra_t, which makes RIPE Atlas Probe/Anchor unusable as the SELinux Zebra policy forbids many things RIPE Atlas Probe/Anchor needs to work. Fortunately, this seems to be an unintended side effect in the SELinux policy as shipped in Fedora and RHEL: $ grep /usr/sbin/rip /etc/selinux/targeted/contexts/files/file_contexts /usr/sbin/rip.* -- system_u:object_r:zebra_exec_t:s0 $ For the Zebra/FRR component 'rip' (Routing Information Protocol) a wildcard was placed which likely impacts all software starting with '/usr/sbin/rip', even if it's not related to Zebra/FRR at all. Thus I propose the following simple fix, that does not impact Zebra/FRR's 'rip' but unbreaks RIPE Atlas Probe/Anchor's /usr/sbin/ripe-atlas (and I explicitly added a wildcard to cover possible future sub-components as well): /usr/sbin/ripe-atlas.* -- system_u:object_r:bin_t:s0 Version-Release number of selected component (if applicable): selinux-policy-targeted-38.1.11-2.0.1.el9_2.noarch Actual Results: SELinux labels RIPE Atlas Probe/Anchor's /usr/sbin/ripe-atlas process as zebra_t when started via ripe-atlas.service Expected Results: SELinux labels RIPE Atlas Probe/Anchor's /usr/sbin/ripe-atlas process as unconfined_t when started via ripe-atlas.service Additional info: Clone of bug #2213604 from Fedora for RHEL 9.
Commit to backport: b91d9a5b6 (HEAD -> rawhide, upstream/rawhide) Label only /usr/sbin/ripd and ripngd with zebra_exec_t
Zdenek, is there a realistic chance for a backport to RHEL 9.2.z, if I file a RHBZ and a case via CEE/GSS?
(In reply to Robert Scheck from comment #4) > Zdenek, is there a realistic chance for a backport to RHEL 9.2.z, if I file > a RHBZ and a case via CEE/GSS? There needs to be justification for accepting such a request.
I opened case 03565036 at the Red Hat customer portal and provided a justification there. In the end, we need the fix in RHEL 9.3 GA and RHEL 9.2.z. Please let me know if something else is needed.
Dmitri, Please follow your organization workflow to request a z-stream backport, it's not done manually.