Bug 749205 - useradd -Z ... executes /usr/sbin/semanage but policycoreutils-python are not required
Summary: useradd -Z ... executes /usr/sbin/semanage but policycoreutils-python are not...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: shadow-utils
Version: 6.2
Hardware: All
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: Dalibor Pospíšil
URL:
Whiteboard:
Depends On:
Blocks: 836160 947775 1070830
TreeView+ depends on / blocked
 
Reported: 2011-10-26 13:35 UTC by Milos Malik
Modified: 2014-07-21 15:32 UTC (History)
2 users (show)

Fixed In Version: shadow-utils-4.1.4.2-14.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-07-21 15:32:39 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Milos Malik 2011-10-26 13:35:26 UTC
Description of problem:
I'm referring to:
https://bugzilla.redhat.com/show_bug.cgi?id=639900#c4
https://bugzilla.redhat.com/show_bug.cgi?id=639900#c5
https://bugzilla.redhat.com/show_bug.cgi?id=639900#c7

Version-Release number of selected component (if applicable):
shadow-utils-4.1.4.2-13.el6

How reproducible:
always

Steps to Reproduce:
# rpm -e policycoreutils-python
# useradd -Z user_u userXYZ
Failed to exec '/usr/sbin/semanage'
useradd: warning: the user name userXYZ to user_u SELinux user mapping failed.
# echo $?
14
#
  
Actual results:
* useradd executes /usr/sbin/semanage

Expected results:
* useradd calls the correct libsemanage functions

Comment 2 Milos Malik 2011-10-26 15:06:31 UTC
# rpm -q policycoreutils-python
policycoreutils-python-2.0.83-19.16.el6.x86_64
# useradd -Z staff_u testuser
# semanage login -l

Login Name                SELinux User              MLS/MCS Range            

__default__               unconfined_u              s0-s0:c0.c1023           
root                      unconfined_u              s0-s0:c0.c1023           
system_u                  system_u                  s0-s0:c0.c1023           
testuser                  staff_u                   s0                       
# rpm -e policycoreutils-python
# userdel -rfZ testuser
# semanage login -l
-bash: /usr/sbin/semanage: No such file or directory
# yum -y -q install policycoreutils-python
Warning: RPMDB altered outside of yum.
** Found 1 pre-existing rpmdb problem(s), 'yum check' output follows:
selinux-policy-minimum-3.7.19-119.el6.noarch has missing requires of policycoreutils-python >= ('0', '2.0.78', '1')
# semanage login -l

Login Name                SELinux User              MLS/MCS Range            

__default__               unconfined_u              s0-s0:c0.c1023           
root                      unconfined_u              s0-s0:c0.c1023           
system_u                  system_u                  s0-s0:c0.c1023           
testuser                  staff_u                   s0                       
# 

It seems that userdel needs semanage too.

Comment 3 Milos Malik 2011-10-26 15:15:53 UTC
# rpm -q policycoreutils-python
policycoreutils-python-2.0.83-19.16.el6.x86_64
# useradd -Z staff_u testuser
# semanage login -l

Login Name                SELinux User              MLS/MCS Range            

__default__               unconfined_u              s0-s0:c0.c1023           
root                      unconfined_u              s0-s0:c0.c1023           
system_u                  system_u                  s0-s0:c0.c1023           
testuser                  staff_u                   s0                       
# rpm -e policycoreutils-python
# usermod -Z staff_u testuser
Failed to exec '/usr/sbin/semanage'
usermod: warning: the user name testuser to staff_u SELinux user mapping failed.
# echo $?
13
# 

Unfortunately, usermod needs semanage too.

Comment 5 Peter Vrabec 2011-11-02 15:37:02 UTC
I'm sorry Milos but I'm not going to add policycoreutils-python to requirements. This would drag another ugly dependencies which would break minimal platform and that would cause problem with certifications and so on ....

What would be the best is to replace semanage with a library call. I talk to selinux guys about this option. If it is doable, I'll be glad to fix it. :)

Comment 7 Suzanne Logcher 2012-02-14 23:18:43 UTC
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

Comment 8 RHEL Program Management 2012-09-07 05:08:09 UTC
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.

Comment 9 RHEL Program Management 2013-10-14 00:55:46 UTC
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.

Comment 13 Miroslav Vadkerti 2014-07-21 14:29:36 UTC
This is causing a regression in Common Criteria. With this fix the selinux user adding is not audited with ROLE_ASSIGN event. Fixing this bug would require fixing libsemanage and possibly also policycoreutils-python to use the libsemanage correctly:
https://bugzilla.redhat.com/show_bug.cgi?id=952237

Comment 14 Miroslav Vadkerti 2014-07-21 14:30:35 UTC
If this request is not backed by any customer, I would recommend to remove it from the update to get back to Common Criteria acceptable state.

Comment 16 Tomas Mraz 2014-07-21 15:32:39 UTC
Closing as WONTFIX then.


Note You need to log in before you can comment on or make changes to this bug.