Bug 441054 - udev sets symlink context on symlink target
Summary: udev sets symlink context on symlink target
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: udev
Version: 5.2
Hardware: All
OS: Linux
high
low
Target Milestone: rc
: ---
Assignee: Harald Hoyer
QA Contact: Milan Zázrivec
URL:
Whiteboard:
: 440290 (view as bug list)
Depends On:
Blocks: 439080 439082
TreeView+ depends on / blocked
 
Reported: 2008-04-05 16:20 UTC by Milan Zázrivec
Modified: 2008-07-02 09:19 UTC (History)
4 users (show)

Fixed In Version: RHBA-2008-0374
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-05-21 15:59:36 UTC


Attachments (Terms of Use)
/var/log/messages (324.29 KB, text/plain)
2008-04-05 16:20 UTC, Milan Zázrivec
no flags Details
/var/log/messages (4.62 KB, text/plain)
2008-04-07 22:30 UTC, Milan Zázrivec
no flags Details
possible patch (988 bytes, patch)
2008-04-09 09:36 UTC, Harald Hoyer
no flags Details | Diff
better patch (1.76 KB, patch)
2008-04-09 10:02 UTC, Harald Hoyer
no flags Details | Diff
final patch - backported from later versions (508 bytes, patch)
2008-04-09 11:28 UTC, Harald Hoyer
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2008:0374 normal SHIPPED_LIVE udev bug fix update 2008-05-20 13:23:41 UTC

Description Milan Zázrivec 2008-04-05 16:20:25 UTC
Description of problem:
Starting openibd service cause several block devices being relabeled.

Version-Release number of selected component (if applicable):
openib-1.3-2.el5

How reproducible:
Always

Steps to Reproduce:
1. Install any of the recent RHEL5.2 snapshots, openib package included.
2. ls -Z /dev/[sh]d*
3. /etc/init.d/openibd start
4. ls -Z /dev/[sh]d*
  
Actual results:
Before openibd is started:
# ls -Z /dev/[hs]d*
brw-rw----  root disk system_u:object_r:fixed_disk_device_t /dev/hda
brw-r-----  root disk system_u:object_r:fixed_disk_device_t /dev/sda
brw-r-----  root disk system_u:object_r:fixed_disk_device_t /dev/sda1
brw-r-----  root disk system_u:object_r:fixed_disk_device_t /dev/sda2

After the service is started:
# ls -Z /dev/[hs]d*
brw-rw----  root disk system_u:object_r:device_t       /dev/hda
brw-r-----  root disk system_u:object_r:device_t       /dev/sda
brw-r-----  root disk system_u:object_r:device_t       /dev/sda1
brw-r-----  root disk system_u:object_r:device_t       /dev/sda2

This all leads to avc denials everytime any of these devices is being accessed.

Additional info:
The devices are relabeled after the init.d script calls udevtrigger. I'm not
sure whether this is openib or a udev problem. Nonetheless I'm attaching 
/var/log/messages output produced after I called udevtrigger manually (this
one command alone of course caused the mentioned relabel).

Comment 1 Milan Zázrivec 2008-04-05 16:20:25 UTC
Created attachment 301376 [details]
/var/log/messages

Comment 2 Milan Zázrivec 2008-04-05 16:23:30 UTC
*** Bug 440290 has been marked as a duplicate of this bug. ***

Comment 3 Doug Ledford 2008-04-07 15:08:39 UTC
Any input on why udev is doing this Bill?  Or should I just revert to the old
initscript method of scanning hwconf for driver entries instead of using
udevtrigger?

Comment 4 Bill Nottingham 2008-04-07 16:11:50 UTC
udevtrigger generates events for the devices in /sys. I'm not sure why that
would cause a relabel, though.

Does echo '1' (or 'add') to /sys/block/sda/uevent cause the mislabeling as well?

Comment 5 Doug Ledford 2008-04-07 16:48:09 UTC
I can't answer your question Bill, evidently none of my machines have selinux
enabled and so they all list the device as unlabeled.  Milan, can you check this?

Comment 6 Milan Zázrivec 2008-04-07 17:16:21 UTC
(In reply to comment #4)
> Does echo '1' (or 'add') to /sys/block/sda/uevent cause the mislabeling as well?

Bingo!

# ls -Z /dev/sda
brw-r-----  root disk system_u:object_r:fixed_disk_device_t /dev/sda
# echo 1 > /sys/block/sda/uevent 
# ls -Z /dev/sda
brw-r-----  root disk system_u:object_r:device_t       /dev/sda

Comment 7 Milan Zázrivec 2008-04-07 22:30:10 UTC
Created attachment 301574 [details]
/var/log/messages

If that helps, here's part of /var/log/messages showing what's happening after
# echo 1 > /sys/block/sda/uevent

Comment 8 Harald Hoyer 2008-04-08 09:49:45 UTC
Apr  8 06:19:46 ivy udevd-event[2820]: udev_node_mknod: preserve file
'/dev/sda', because it has correct dev_t

though it re-sets the selinux context...
                selinux_setfilecon(file, udev->dev->kernel_name, stats.st_mode);


Comment 9 Harald Hoyer 2008-04-08 10:02:35 UTC
on creation:
selinux_setfscreatecon:
   matchpathcon(file, mode, &scontext)
   setfscreatecon(scontext);
mknod(...);

in this case:
selinux_setfilecon:
   matchpathcon(file, mode, &scontext)
   setfilecon(file, scontext);


I don't see anything, which would trigger a wrong relabel.

Daniel?

Comment 10 Doug Ledford 2008-04-08 13:46:39 UTC
At this point, my question is whether or not we have established that this isn't
really an openib bug and this needs to be switched to another component and
assigned to that person?

Comment 11 Daniel Walsh 2008-04-08 14:21:54 UTC
If the devices are recreated without going through the udev code path to
setfilecon or setfscreatecon they would end up labeled device_t.

Comment 12 Milan Zázrivec 2008-04-08 14:46:45 UTC
(In reply to comment #10)
> At this point, my question is whether or not we have established that this isn't
> really an openib bug and this needs to be switched to another component and
> assigned to that person?

None of the openib bits have to be present for this problem to pop up. All you
have to do is to run udevtrigger. I'm not sure what's actually causing the
problem, but I certainly don't want this bugzilla to be sitting in a wrong
component.

Is there anything I can help with?

Comment 13 Daniel Walsh 2008-04-08 15:00:05 UTC
I think this should be moved to udev.

Comment 15 Harald Hoyer 2008-04-09 08:55:22 UTC
Seems like a problem with udev setting the selinux context again for symlinks.

Comment 16 Harald Hoyer 2008-04-09 09:36:33 UTC
Created attachment 301766 [details]
possible patch

Comment 17 Harald Hoyer 2008-04-09 10:02:06 UTC
Created attachment 301767 [details]
better patch

Comment 18 Harald Hoyer 2008-04-09 10:05:51 UTC
dwalsh, what context should the symlinks in /dev/disk have?

# ls -Z /dev/disk/*
/dev/disk/by-id:
lrwxrwxrwx  root root system_u:object_r:device_t       ata-QEMU_HARDDISK_QM00001
-> ../../hda

# ls -Z /dev/hda
brw-r-----  root disk system_u:object_r:fixed_disk_device_t /dev/hda


Comment 19 Harald Hoyer 2008-04-09 10:15:04 UTC
 SELinux is preventing /sbin/udevd (rpm_script_t) "create" to
ata-QEMU_HARDDISK_QM00001 (fixed_disk_device_t).

seems like we can't set the same context for the symlinks.

Comment 20 Harald Hoyer 2008-04-09 11:28:17 UTC
Created attachment 301781 [details]
final patch - backported from later versions

Comment 21 Daniel Walsh 2008-04-09 12:07:11 UTC
Symlinks should not be being set, the problem here is the block devices are
being mislabeled.  Symlinks should be device_t while block devices should be
labeled fixed_disk_device_t



Comment 22 Milan Zázrivec 2008-04-09 17:48:46 UTC
I'm confirming that the patch from comment #20 solves the problem (udev built
locally, tested on RHEL5.2-Server-20080409.nightly / i386).

Comment 23 Phil Knirsch 2008-04-10 12:28:29 UTC
Giving Devel ACK as per comment #20 and comment #22.

Thanks,

Read ya, Phil

Comment 26 Milan Zázrivec 2008-04-22 08:32:51 UTC
Verified with udev-095-14.15.el5 / RHEL5.2-Server-20080422.nightly

Comment 28 errata-xmlrpc 2008-05-21 15:59:36 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2008-0374.html



Note You need to log in before you can comment on or make changes to this bug.