Bug 799817 - SELinux policy missing postfix /lib64 fcontext in chroot
SELinux policy missing postfix /lib64 fcontext in chroot
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
16
Unspecified Linux
unspecified Severity unspecified
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-03-05 01:23 EST by Scott Shambarger
Modified: 2012-06-22 20:06 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-06-22 20:06:17 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Scott Shambarger 2012-03-05 01:23:27 EST
Description of problem:
selinux-policy-targeted-3.10.0 is missing correct fcontext for /lib64

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.10.0-75
selinux-policy-targeted-3.10.0

How reproducible:
Anytime postfix smtpd uses libraries

Steps to Reproduce:
1. Install postfix with chroot enabled 64bit
2. Enable selinux
3. Attempt any function that requires a library in /lib64
  
Additional info:

Present in /etc/selinux/targeted/contexts/files/file_contexts
/var/spool/postfix/lib(/.*)?    system_u:object_r:lib_t:s0

Missing in /etc/selinux/targeted/contexts/files/file_contexts.subs
/var/spool/postfix/lib64 /var/spool/postfix/lib
Comment 1 Miroslav Grepl 2012-03-05 05:07:16 EST
You are right. This is a bug.
Comment 2 Scott Shambarger 2012-04-16 14:29:42 EDT
This seems like an easy change... any chance it'll make it in the next release? (I'd love to remove my workaround)
Comment 3 Daniel Walsh 2012-04-20 10:29:24 EDT
Added label to F17,
Comment 4 Miroslav Grepl 2012-04-20 11:24:57 EDT
Should be fixed in the latest F16 policy.

$ yum update selinux-policy --enablerepo=updates-testing
Comment 5 Scott Shambarger 2012-04-23 14:30:04 EDT
Is this present in 3.10.0-84? I don't see any labels for /var/spool/postfix/lib64 in that build...
Comment 6 Miroslav Grepl 2012-04-23 14:56:36 EDT
yes, it is

$ matchpathcon /var/spool/postfix/lib64
Comment 7 Scott Shambarger 2012-04-23 16:07:30 EDT
# rpm -q selinux-policy-targeted
selinux-policy-targeted-3.10.0-84.fc16.noarch
# matchpathcon /var/spool/postfix/lib64
/var/spool/postfix/lib64        system_u:object_r:postfix_spool_t:s0

... shouldn't the fcontext be lib_t?
Comment 8 Scott Shambarger 2012-05-18 11:39:21 EDT
Tried with latest latest release (3.10.0-86), and it's finally included.  Appears to be fixed now, thanks! :)

Note You need to log in before you can comment on or make changes to this bug.