Bug 599879 - autorelabel process leave system in permissive state
autorelabel process leave system in permissive state
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: initscripts (Show other bugs)
6.0
All Linux
high Severity high
: beta
: ---
Assigned To: initscripts Maintenance Team
Yulia Kopkova
: Regression
: 592176 (view as bug list)
Depends On: 595823
Blocks: 580448 524819
  Show dependency treegraph
 
Reported: 2010-06-03 16:44 EDT by Bill Nottingham
Modified: 2014-03-16 23:23 EDT (History)
16 users (show)

See Also:
Fixed In Version: initscripts-9.03.8-3.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 595823
Environment:
Last Closed: 2010-07-02 15:11:40 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Bill Nottingham 2010-06-03 16:44:51 EDT
+++ This bug was initially created as a clone of Bug #595823 +++

initscripts-9.12-1.fc13.x86_64

# touch /.autorelabel
# reboot

Observe on the console:

...
dracut: Loading SELinux policy
type=1404 audit(1274809124.580:2): enforcing=1 old_enforcing=0 auid=4294967295 ses=4294967295
type=1403 audit(1274809124.948:3): policy loaded auid=4294967295 ses=4294967295
type=1404 audit(1274809124.954:4): enforcing=0 old_enforcing=1 auid=4294967295 ses=4294967295
...

*** Warning -- SELinux targeted policy relabel is required.
*** Relabeling could take a very long time, depending on file
*** system size and speed of hard drives.
***********************************************


# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 24
Policy from config file:        targeted

--- Additional comment from notting@redhat.com on 2010-05-25 14:01:05 EDT ---

enforcing needs to be off to ensure that autorelabeling works.

It will either reboot (which will go back to enforcing) or explicitly set it back to the prior state before continuing. See rc.sysinit for details.

--- Additional comment from chepkov@yahoo.com on 2010-05-25 14:10:06 EDT ---

That what the reason for the bugzilla report
It does not set it back to enforcing after it's done

--- Additional comment from bucketofsnow@gmail.com on 2010-05-26 19:39:14 EDT ---

I can confirm this happens when "fixfiles onboot" is used as well.  The same result happens on my x86_64 system and i686 system. (Using either fixfiles onboot or touch /.autorelabel)

--- Additional comment from dwalsh@redhat.com on 2010-05-27 11:46:20 EDT ---

It is being caused by dracut.

In selinux-loadpolicy.sh  we have


	if [ $ret -eq 0 -o $ret -eq 2 ]; then
	    # If machine requires a relabel, force to permissive mode
	    [ -e "$NEWROOT"/.autorelabel ] && ( echo 0 > "$NEWROOT"/selinux/enforce )
	    return 0
	fi

Which causes the rc.sysinit to see it in permissive mode.

--- Additional comment from dwalsh@redhat.com on 2010-05-27 11:51:38 EDT ---

Having dracut set the permissive flag on boot helps in that if /bin/init is mislabeled of /lib and /usr/lib, apps will blow up before the restorecon starts.

But we need to tell init what the state of the box should be from dracut.

Or have the init script figure it out.

We need to check the kernel flag enforcing=0 and the enforcing flag in /etc/selinux/config and set it back to the proper state once the relabel finishes.

--- Additional comment from notting@redhat.com on 2010-05-27 11:58:24 EDT ---

Alternatively, we could have it *always* reboot. That's a hack, though.

--- Additional comment from dwalsh@redhat.com on 2010-05-27 13:27:49 EDT ---

Well actually that might be the correct behaviour, since way of knowing whether the rest of the machine was started correctly.   Of course you might end up in an infinite loop of reboots if the autorelabel=1 flag gets added to the /etc/grub.conf.
Comment 1 Bill Nottingham 2010-06-03 16:48:01 EDT
*** Bug 592176 has been marked as a duplicate of this bug. ***
Comment 2 RHEL Product and Program Management 2010-06-03 17:03:18 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.
Comment 3 Bill Nottingham 2010-06-03 17:03:49 EDT
Marking as blocker as this hits the kdump path (see duplicate bug.)
Comment 4 CAI Qian 2010-06-07 04:56:10 EDT
*** Bug 597229 has been marked as a duplicate of this bug. ***
Comment 7 releng-rhel@redhat.com 2010-07-02 15:11:40 EDT
Red Hat Enterprise Linux Beta 2 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.