Bug 851969 - icedtea-web created files initially mislabeled
icedtea-web created files initially mislabeled
Status: CLOSED CANTFIX
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy (Show other bugs)
6.3
All Linux
low Severity low
: rc
: ---
Assigned To: Miroslav Grepl
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-08-27 03:26 EDT by Marko Myllynen
Modified: 2012-10-11 04:22 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-10-09 09:22:19 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Marko Myllynen 2012-08-27 03:26:02 EDT
Description of problem:
localhost:~> rm -rf ~/.icedtea
localhost:~> restorecon -v -R ~/
localhost:~> firefox http://javatester.org/version.html
java version "1.6.0_24"
OpenJDK Runtime Environment (IcedTea6 1.11.3)
(rhel-1.48.1.11.3.el6_2-x86_64)
OpenJDK 64-Bit Server VM (build 20.0-b12, mixed mode)
localhost:~> restorecon -v -R ~/
restorecon reset /home/testuser/.icedtea/security context
unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.clientcerts
context
unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.jssecerts
context
unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.certs context
unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.jssecacerts
context
unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.cacerts
context
unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
localhost:~>

Version-Release number of selected component (if applicable):
RHEL 6.3
Comment 2 Miroslav Grepl 2012-08-27 07:26:38 EDT
Marko,
what does

# id -Z
Comment 3 Marko Myllynen 2012-08-27 11:23:58 EDT
localhost:~> id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
localhost:~>
Comment 4 Daniel Walsh 2012-08-29 12:51:38 EDT
ls -ldZ /home/testuser

I think you need to relabel this directory.

restorecon -R -v /home
Comment 5 Milos Malik 2012-08-30 04:22:41 EDT
# useradd testuser
# passwd testuser
Changing password for user testuser.
New password: 
Retype new password: 
passwd: all authentication tokens updated successfully.
# ls -dZ /home/testuser/
drwx------. testuser testuser unconfined_u:object_r:user_home_dir_t:s0 /home/testuser/
#

$ ssh -X testuser@192.168.122.55
testuser@192.168.122.55's password: 
/usr/bin/xauth:  creating new authority file /home/testuser/.Xauthority
[testuser@rhel64 ~]$ id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
[testuser@rhel64 ~]$ restorecon -Rv ~/
[testuser@rhel64 ~]$ rm -rf .icedtea
[testuser@rhel64 ~]$ firefox http://javatester.org/version.html
failed to create drawable
failed to create drawable
GConf Error: Failed to contact configuration server; some possible causes are that you need to enable TCP/IP networking for ORBit, or you have stale NFS locks due to a system crash. See http://projects.gnome.org/gconf/ for information. (Details -  1: Failed to get connection to session: /bin/dbus-launch terminated abnormally without any error message)
java version "1.6.0_24"
OpenJDK Runtime Environment (IcedTea6 1.11.1) (rhel-1.45.1.11.1.el6-i386)
OpenJDK Client VM (build 20.0-b12, mixed mode)
[testuser@rhel64 ~]$ restorecon -Rv ~/
restorecon reset /home/testuser/.icedtea context unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/cache context unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/cache/recently_used context unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security context unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.jssecacerts context unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.jssecerts context unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.cacerts context unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.clientcerts context unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
restorecon reset /home/testuser/.icedtea/security/trusted.certs context unconfined_u:object_r:user_home_dir_t:s0->unconfined_u:object_r:user_home_t:s0
[testuser@rhel64 ~]$

No matter how many times I repeat the last 3 commands,  ~/.icedtea directory is always created mislabelled.
Comment 6 Marko Myllynen 2012-08-30 04:49:12 EDT
(In reply to comment #4)
> ls -ldZ /home/testuser
> 
> I think you need to relabel this directory.
> 
> restorecon -R -v /home

As Milos noted, this doesn't help. But it turns out that when creating a new user and logging via GDM with the following steps

# restorecon -R /home
# useradd testuser
# passwd testuser
## GDM/GNOME login / logout as testuser

then restorecon -R -v /home/testuser reveals that in addition to .icedtea several other files are mislabelled as well, including files under .gnupg and .dbus.

This should be trivial to reproduce. Thanks.
Comment 7 Miroslav Grepl 2012-09-11 07:41:37 EDT
Marko,
what does

# ps -efZ |grep restore
Comment 8 Marko Myllynen 2012-09-11 07:56:53 EDT
localhost:~> ps -efZ | grep '[r]estore'
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 testuser 2792 2628
 0 10:50 ? 00:00:00 /usr/sbin/restorecond -u
localhost:~>
Comment 9 Daniel Walsh 2012-09-18 10:59:53 EDT
Well that would only be running if the user was logged in via gdm.  Since he is logging in via ssh, the files will be mislabeled until restorecond -u runs.  This is an issue we have fixed in RHEL7 with filename_translations, but really can not fix it on RHEL6.
Comment 10 Marko Myllynen 2012-09-18 11:03:00 EDT
(In reply to comment #9)
> Well that would only be running if the user was logged in via gdm.  Since he
> is logging in via ssh, the files will be mislabeled until restorecond -u
> runs.  This is an issue we have fixed in RHEL7 with filename_translations,
> but really can not fix it on RHEL6.

I didn't use SSH but a local login via GDM when I reported this.

Thanks.
Comment 11 Daniel Walsh 2012-09-18 11:42:10 EDT
Ok I am looking at this closer now,  I did not see that the content was labeled as userdom_home_dir_t rather then user_home_t.  What process is creating the .icetea directory?  Is this created via ssh -X command?
Comment 12 Marko Myllynen 2012-09-20 03:56:00 EDT
(In reply to comment #11)
> Ok I am looking at this closer now,  I did not see that the content was
> labeled as userdom_home_dir_t rather then user_home_t.  What process is
> creating the .icetea directory?  Is this created via ssh -X command?

No ssh used, see comment 0. When running "firefox http://javatester.org/version.html" firefox will start "java" to show the applet which in turn creates .icedtea if OpenJDK is in use. But as I noted in comment 6 this seems not to be limited to firefox/java, there are also quite a few mislabeled files after initial user login.

Thanks.
Comment 13 Miroslav Grepl 2012-10-09 09:22:19 EDT
We are not able fix this issue in RHEL6. We have  restorecond for this. 

Milos, 
does it work for you if you don't use ssh?
Comment 14 Milos Malik 2012-10-09 10:57:15 EDT
When I log into my RHEL-6.4 machine and follow the scenario I see the same "restorecon reset" messages as Marko. /home/testuser/.icedtea/security is labelled user_home_dir_t instead of user_home_t.
Comment 15 Miroslav Grepl 2012-10-10 07:05:44 EDT
Is restorecond running for your session?
Comment 16 Marko Myllynen 2012-10-11 04:22:10 EDT
(In reply to comment #15)
> Is restorecond running for your session?

ssh was not involved at all when this was reported originally, see comment 0 and comment 10. And as stated in comment 8 restorecond is running. Also see comment 6 and comment 12 - mislabeled files are not just under .icedtea but include files for example under .gpg and .dbus.

Thanks.

Note You need to log in before you can comment on or make changes to this bug.