+++ This bug was initially created as a clone of Bug #2316388 +++ Original context and information in https://github.com/coreos/fedora-coreos-tracker/issues/1806 When running semodule -N --refresh on Fedora CoreOS we are seeing files get created that have the wrong file contexts: ``` root@cosa-devsh:~# restorecon -rvn /etc/selinux root@cosa-devsh:~# semodule -N --refresh root@cosa-devsh:~# restorecon -rvn /etc/selinux Would relabel /etc/selinux/targeted/active/booleans.local from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 ... ... ``` I traced the Fedora CoreOS rawhide history and found this behavior was introduced in: ``` BISECT TEST RESULTS: Last known good build: 42.20240911.91.0 First known bad build: 42.20240914.91.0 ``` which had the following changeset: ``` ostree diff commit from: 3a8acb2a5b7971084404216fb7c1d0282f626c7186618c361aa4545fbe3493b8 ostree diff commit to: 766159d55230282690a7e11cbe836fe06b26c62d846f9ba256bd4e9489e9e7d3 Upgraded: bootc 0.1.15-1.fc42 -> 0.1.16-1.fc42 conmon 2:2.1.12-2.fc41 -> 2:2.1.12-3.fc42 container-selinux 2:2.232.1-2.fc41 -> 2:2.233.0-1.fc42 crun 1.15-2.fc41 -> 1.17-1.fc42 crun-wasm 1.15-2.fc41 -> 1.17-1.fc42 curl 8.9.1-3.fc42 -> 8.10.0-1.fc42 gnutls 3.8.7-2.fc42 -> 3.8.7-4.fc42 kbd 2.6.4-4.fc41 -> 2.6.4-5.fc42 kbd-legacy 2.6.4-4.fc41 -> 2.6.4-5.fc42 kbd-misc 2.6.4-4.fc41 -> 2.6.4-5.fc42 kernel 6.11.0-0.rc7.56.fc42 -> 6.11.0-0.rc7.20240913git196145c606d0.60.fc42 kernel-core 6.11.0-0.rc7.56.fc42 -> 6.11.0-0.rc7.20240913git196145c606d0.60.fc42 kernel-modules 6.11.0-0.rc7.56.fc42 -> 6.11.0-0.rc7.20240913git196145c606d0.60.fc42 kernel-modules-core 6.11.0-0.rc7.56.fc42 -> 6.11.0-0.rc7.20240913git196145c606d0.60.fc42 libcurl-minimal 8.9.1-3.fc42 -> 8.10.0-1.fc42 libgcc 14.2.1-2.fc42 -> 14.2.1-3.fc42 libldb 2:4.21.0-7.fc42 -> 2:4.21.0-9.fc42 libselinux 3.7-5.fc41 -> 3.7-6.fc42 libselinux-utils 3.7-5.fc41 -> 3.7-6.fc42 libsemanage 3.7-2.fc41 -> 3.7-3.fc42 libsepol 3.7-2.fc41 -> 3.7-3.fc42 libsmbclient 2:4.21.0-7.fc42 -> 2:4.21.0-9.fc42 libstdc++ 14.2.1-2.fc42 -> 14.2.1-3.fc42 libwbclient 2:4.21.0-7.fc42 -> 2:4.21.0-9.fc42 microcode_ctl 2:2.1-64.fc42 -> 2:2.1-65.fc42 openssl 1:3.2.2-5.fc41 -> 1:3.2.2-8.fc42 openssl-libs 1:3.2.2-5.fc41 -> 1:3.2.2-8.fc42 rpm 4.19.93-1.fc42 -> 4.19.94-1.fc42 rpm-libs 4.19.93-1.fc42 -> 4.19.94-1.fc42 rpm-plugin-selinux 4.19.93-1.fc42 -> 4.19.94-1.fc42 samba-client-libs 2:4.21.0-7.fc42 -> 2:4.21.0-9.fc42 samba-common 2:4.21.0-7.fc42 -> 2:4.21.0-9.fc42 samba-common-libs 2:4.21.0-7.fc42 -> 2:4.21.0-9.fc42 selinux-policy 41.16-1.fc42 -> 41.17-1.fc42 selinux-policy-targeted 41.16-1.fc42 -> 41.17-1.fc42 zlib-ng-compat 2.1.7-2.fc41 -> 2.1.7-3.fc42 ``` I realize that policycoreutils wasn't changed in that update so it's probably either the policy or selinux libraries so feel free to move this to the appropriate component. Reproducible: Always --- Additional comment from Petr Lautrbach on 2024-10-04 11:10:18 CEST --- Most likely related to https://github.com/SELinuxProject/selinux/commit/d96f27bf7cb918cfd3123c5281381ef8b5196ac3 --- Additional comment from Dusty Mabe on 2024-10-30 20:14:26 CET --- Hi Petr. Any updates on this? --- Additional comment from Petr Lautrbach on 2024-11-05 16:19:23 CET --- The problem seems to be in libsemanage which copies files from /active/ to /tmp/ and relabels them there. In standard system, this is not an issue as both locations translate to the same context, e.g. root@localhost:~# matchpathcon /var/lib/selinux/targeted/active/booleans.local /var/lib/selinux/targeted/tmp/booleans.local /var/lib/selinux/targeted/active/booleans.local system_u:object_r:semanage_store_t:s0 /var/lib/selinux/targeted/tmp/booleans.local system_u:object_r:semanage_store_t:s0 But it differs on coreos where semanage-store is set to /etc/selinux : root@localhost:~# matchpathcon /etc/selinux/targeted/active/booleans.local /etc/selinux/targeted/tmp/booleans.local /etc/selinux/targeted/active/booleans.local system_u:object_r:semanage_store_t:s0 /etc/selinux/targeted/tmp/booleans.local system_u:object_r:selinux_config_t:s0 I see two possible solutions for this and I guess both should be applied: 1. add fcontext mapping for '/etc/selinux/(minimum|mls|targeted)/tmp(/.*)?' this can be also used as a local workaround: root@localhost:~# semodule -N --refresh root@localhost:~# restorecon -rvn /etc/selinux | head Would relabel /etc/selinux/targeted/active/booleans.local from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 Would relabel /etc/selinux/targeted/active/file_contexts from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 Would relabel /etc/selinux/targeted/active/file_contexts.homedirs from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 root@localhost:~# restorecon -rF /etc/selinux root@localhost:~# semanage fcontext -a -t semanage_store_t '/etc/selinux/(minimum|mls|targeted)/tmp(/.*)?' root@localhost:~# semodule -N --refresh root@localhost:~# restorecon -rvn /etc/selinux | head 2. fix libsemanage to set files context on final destination after /tmp/ is renamed to /active/
https://github.com/fedora-selinux/selinux-policy/pull/2420
FEDORA-2024-bbef94e809 (selinux-policy-41.25-1.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2024-bbef94e809
FEDORA-2024-bbef94e809 has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-bbef94e809` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-bbef94e809 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2024-bbef94e809 (selinux-policy-41.25-1.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.
I think this is looking good. I only see one more set of files that get labeled incorrectly now: ``` [core@cosa-devsh ~]$ sudo restorecon -rvn /etc/selinux [core@cosa-devsh ~]$ sudo semodule -N --refresh [core@cosa-devsh ~]$ sudo restorecon -rvn /etc/selinux Would relabel /etc/selinux/targeted/semanage.read.LOCK from unconfined_u:object_r:semanage_trans_lock_t:s0 to unconfined_u:object_r:selinux_config_t:s0 Would relabel /etc/selinux/targeted/semanage.trans.LOCK from unconfined_u:object_r:semanage_trans_lock_t:s0 to unconfined_u:object_r:selinux_config_t:s0 [core@cosa-devsh ~]$ [core@cosa-devsh ~]$ rpm -q selinux-policy libse libseccomp libselinux libselinux-utils libsemanage libsepol [core@cosa-devsh ~]$ rpm -q selinux-policy libse libseccomp libselinux libselinux-utils libsemanage libsepol [core@cosa-devsh ~]$ rpm -q selinux-policy libsemanage policycoreutils selinux-policy-41.25-1.fc41.noarch libsemanage-3.7-2.fc41.x86_64 policycoreutils-3.7-3.fc41.x86_64 ``` Should we open a separate issue? Also, should the original bug be updated? https://bugzilla.redhat.com/show_bug.cgi?id=2316388
ok maybe I spoke too soon.. on F41 I only see those two files with the wrong labels but in f42/rawhide I still see a lot of wrongly labeled stuff: ``` [core@cosa-devsh ~]$ sudo restorecon -rvn /etc/selinux [core@cosa-devsh ~]$ sudo semodule -N --refresh [core@cosa-devsh ~]$ sudo restorecon -rvn /etc/selinux Would relabel /etc/selinux/targeted/semanage.read.LOCK from unconfined_u:object_r:semanage_trans_lock_t:s0 to unconfined_u:object_r:selinux_config_t:s0 Would relabel /etc/selinux/targeted/semanage.trans.LOCK from unconfined_u:object_r:semanage_trans_lock_t:s0 to unconfined_u:object_r:selinux_config_t:s0 Would relabel /etc/selinux/targeted/active/modules from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 Would relabel /etc/selinux/targeted/active/modules/100 from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 Would relabel /etc/selinux/targeted/active/modules/100/acct from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 Would relabel /etc/selinux/targeted/active/modules/100/acct/cil from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 Would relabel /etc/selinux/targeted/active/modules/100/acct/hll from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 Would relabel /etc/selinux/targeted/active/modules/100/acct/lang_ext from system_u:object_r:selinux_config_t:s0 to system_u:object_r:semanage_store_t:s0 ... ... ... ... [core@cosa-devsh ~]$ rpm -q selinux-policy libsemanage policycoreutils selinux-policy-41.25-1.fc42.noarch libsemanage-3.7-3.fc42.x86_64 policycoreutils-3.7-5.fc42.x86_64 ```
the fix does not appear to be in tag: v41.25
This bug appears to have been reported against 'rawhide' during the Fedora Linux 42 development cycle. Changing version to 42.
Should be fixed in selinux-policy-41.26-2.fc41 and newer.