Bug 2478116 - SELinux: kiwi %post unnecessarily labels symlinks with install_exec_t, causing lsmd AVC denials
Summary: SELinux: kiwi %post unnecessarily labels symlinks with install_exec_t, causin...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: kiwi
Version: 45
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Neal Gompa
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-16 00:29 UTC by Alejandro
Modified: 2026-09-19 01:14 UTC (History)
3 users (show)

Fixed In Version: kiwi-11.0.2-1.fc45 kiwi-11.0.2-1.el10_3 kiwi-11.0.2-1.el10_4 kiwi-11.0.2-1.fc43 kiwi-11.0.2-1.el10_2 kiwi-11.0.2-1.fc44
Clone Of:
Environment:
Last Closed: 2026-09-19 00:17:36 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Alejandro 2026-05-16 00:29:05 UTC
kiwi's %post cli labels /usr/bin/kiwi and /usr/bin/kiwi-ng symlinks as
install_exec_t. This causes AVC denials from lsmd (libStorageMgmt) which
scans /usr/bin/ at boot and calls stat() on all entries. The lsmd_t policy
allows getattr on exec_type:file but not lnk_file.

Only the actual binary (/usr/bin/kiwi-ng-3) needs install_exec_t — SELinux
resolves symlinks on exec, so the binary label is sufficient for domain
transitions.

Reproducible: Always

Steps to Reproduce:
sudo dnf install kiwi-cli
sudo setenforce 1
sudo truncate -s 0 /var/log/audit/audit.log
sudo systemctl restart libstoragemgmt
sudo grep "denied.*lsmd" /var/log/audit/audit.log
Actual Results:
AVC denials are logged every time lsmd starts:

type=AVC msg=audit(...): avc: denied { getattr } for comm="lsmd" path="/usr/bin/kiwi" scontext=system_u:system_r:lsmd_t:s0 tcontext=system_u:object_r:install_exec_t:s0 tclass=lnk_file
type=AVC msg=audit(...): avc: denied { getattr } for comm="lsmd" path="/usr/bin/kiwi-ng" scontext=system_u:system_r:lsmd_t:s0 tcontext=system_u:object_r:install_exec_t:s0 tclass=lnk_file

Expected Results:
No AVC denials. The symlinks should have the default bin_t label since only the actual binary needs install_exec_t for domain transitions.

Additional Information:
- Introduced in commit c1ed67 ("Apply install_exec_t SELinux file context to kiwi executables")
- The lsmd_t policy allows getattr on exec_type:file but not exec_type:lnk_file, so any process scanning /usr/bin/ will hit this
- SELinux resolves symlinks on exec — labeling symlinks serves no security purpose
- Tested fix on AL2023 and Fedora: only labeling kiwi-ng-3 eliminates denials while kiwi continues to work correctly in enforcing mode

Comment 1 Aoife Moloney 2026-08-17 14:40:51 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.

Comment 2 Fedora Update System 2026-09-18 17:22:18 UTC
FEDORA-EPEL-2026-75cc6afd67 (kiwi-11.0.2-1.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-75cc6afd67

Comment 3 Fedora Update System 2026-09-18 17:22:18 UTC
FEDORA-2026-a325558d3a (kiwi-11.0.2-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-a325558d3a

Comment 4 Fedora Update System 2026-09-18 17:22:20 UTC
FEDORA-2026-608c092987 (kiwi-11.0.2-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-608c092987

Comment 5 Fedora Update System 2026-09-18 17:22:20 UTC
FEDORA-EPEL-2026-e12e5f4f1f (kiwi-11.0.2-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e12e5f4f1f

Comment 6 Fedora Update System 2026-09-18 17:22:20 UTC
FEDORA-EPEL-2026-8405851a97 (kiwi-11.0.2-1.el10_4) has been submitted as an update to Fedora EPEL 10.4.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-8405851a97

Comment 7 Fedora Update System 2026-09-18 18:20:33 UTC
FEDORA-2026-94ae6cb693 (kiwi-11.0.2-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-94ae6cb693

Comment 8 Fedora Update System 2026-09-19 00:17:36 UTC
FEDORA-2026-a325558d3a (kiwi-11.0.2-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 9 Fedora Update System 2026-09-19 00:31:26 UTC
FEDORA-EPEL-2026-e12e5f4f1f (kiwi-11.0.2-1.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 10 Fedora Update System 2026-09-19 00:43:16 UTC
FEDORA-EPEL-2026-8405851a97 (kiwi-11.0.2-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 11 Fedora Update System 2026-09-19 00:58:36 UTC
FEDORA-2026-94ae6cb693 (kiwi-11.0.2-1.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 12 Fedora Update System 2026-09-19 01:00:28 UTC
FEDORA-EPEL-2026-75cc6afd67 (kiwi-11.0.2-1.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Fedora Update System 2026-09-19 01:14:38 UTC
FEDORA-2026-608c092987 (kiwi-11.0.2-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.