Bug 799817 - SELinux policy missing postfix /lib64 fcontext in chroot
Summary: SELinux policy missing postfix /lib64 fcontext in chroot
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 16
Hardware: Unspecified
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-03-05 06:23 UTC by Scott Shambarger
Modified: 2012-06-23 00:06 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-06-23 00:06:17 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Scott Shambarger 2012-03-05 06:23:27 UTC 
Description of problem:
selinux-policy-targeted-3.10.0 is missing correct fcontext for /lib64

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.10.0-75
selinux-policy-targeted-3.10.0

How reproducible:
Anytime postfix smtpd uses libraries

Steps to Reproduce:
1. Install postfix with chroot enabled 64bit
2. Enable selinux
3. Attempt any function that requires a library in /lib64
  
Additional info:

Present in /etc/selinux/targeted/contexts/files/file_contexts
/var/spool/postfix/lib(/.*)?    system_u:object_r:lib_t:s0

Missing in /etc/selinux/targeted/contexts/files/file_contexts.subs
/var/spool/postfix/lib64 /var/spool/postfix/lib
Comment 1 Miroslav Grepl 2012-03-05 10:07:16 UTC 
You are right. This is a bug.
Comment 2 Scott Shambarger 2012-04-16 18:29:42 UTC 
This seems like an easy change... any chance it'll make it in the next release? (I'd love to remove my workaround)
Comment 3 Daniel Walsh 2012-04-20 14:29:24 UTC 
Added label to F17,
Comment 4 Miroslav Grepl 2012-04-20 15:24:57 UTC 
Should be fixed in the latest F16 policy.

$ yum update selinux-policy --enablerepo=updates-testing
Comment 5 Scott Shambarger 2012-04-23 18:30:04 UTC 
Is this present in 3.10.0-84? I don't see any labels for /var/spool/postfix/lib64 in that build...
Comment 6 Miroslav Grepl 2012-04-23 18:56:36 UTC 
yes, it is

$ matchpathcon /var/spool/postfix/lib64
Comment 7 Scott Shambarger 2012-04-23 20:07:30 UTC 
# rpm -q selinux-policy-targeted
selinux-policy-targeted-3.10.0-84.fc16.noarch
# matchpathcon /var/spool/postfix/lib64
/var/spool/postfix/lib64        system_u:object_r:postfix_spool_t:s0

... shouldn't the fcontext be lib_t?
Comment 8 Scott Shambarger 2012-05-18 15:39:21 UTC 
Tried with latest latest release (3.10.0-86), and it's finally included.  Appears to be fixed now, thanks! :)
Note You need to log in before you can comment on or make changes to this bug.