Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 885181

Summary:	MLS should be optional while changing default selinuxusermap order
Product:	Red Hat Enterprise Linux 6	Reporter:	Kaleem <ksiddiqu>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED NOTABUG	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.4	CC:	clong, mgrepl, mkosek
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-12-12 14:29:40 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Kaleem 2012-12-07 16:53:34 UTC

Description of problem:

As per http://freeipa.org/page/SELinux_user_mapping ,

"An SELinux user has 3 components: user:MLS:MCS. The latter two are optional, so user:MLS or only user are also valid."

But i see MLS part mandatory rather than optional as per following text in link
 http://documentation-devel.engineering.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Identity_Management_Guide/selinux-mapping.html

"In the IdM server configuration, each SELinux user is configured with both its username and its MLS/MCS range, SELinux_username:MLS[:MCS], and this format is used to identify the SELinux user when configuring maps."

Version-Release number of selected component (if applicable):
[root@rhel64master ~]# rpm -q ipa-server
ipa-server-3.0.0-10.el6.x86_64
[root@rhel64master ~]#

How reproducible:
Always

Steps to Reproduce:
1.Modify default selinux user map order

[root@rhel64master ipa-selinuxusermap-func]# ipa config-show
  Maximum username length: 32
  Home directory base: /home
  Default shell: /bin/sh
  Default users group: ipausers
  Default e-mail domain: testrelm.com
  Search time limit: 2
  Search size limit: 100
  User search fields: uid,givenname,sn,telephonenumber,ou,title
  Group search fields: cn,description
  Enable migration mode: FALSE
  Certificate Subject base: O=TESTRELM.COM
  Password Expiration Notification (days): 4
  Password plugin features: AllowNThash
  SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023
  Default SELinux user: unconfined_u:s0-s0:c0.c1023
  Default PAC types: MS-PAC
[root@rhel64master ipa-selinuxusermap-func]# ipa config-mod --setattr=ipaselinuxusermaporder='test_u$unconfined_u:s0-s0:c0.c1023'ipa: ERROR: invalid 'ipaselinuxusermaporder': SELinux user 'test_u' is not valid: Invalid MLS value, must match s[0-15](-s[0-15])
[root@rhel64master ipa-selinuxusermap-func]#
  
Actual results:
Default ipaselinuxusermaporder is not changed and error message for invalid MLS value is thrown.

Expected results:
Default ipaselinuxusermaporder should be changed without providing MLS/MCS value and there should be no error message.

Additional info:
(1)from link "http://docs.fedoraproject.org/en-US/Fedora/13/html/Security-Enhanced_Linux/chap-Security-Enhanced_Linux-SELinux_Contexts.html"

 "Processes and files are labeled with an SELinux context that contains additional information, such as an SELinux user, role, type, and, optionally, a level."
 
  Which also says that level is optional.

Comment 2 Martin Kosek 2012-12-10 07:41:39 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/3290

Comment 3 Martin Kosek 2012-12-12 08:38:52 UTC

Mirek, could you please comment if SELinux users without MLS value are valid or not? It is unclear to me.

For starters, it is certainly not working with current SELinux version:

# cat /etc/selinux/targeted/logins/admin 
*:staff_u

# semanage login -l

Login Name           SELinux User         MLS/MCS Range        Service

__default__          unconfined_u         s0-s0:c0.c1023       *
root                 unconfined_u         s0-s0:c0.c1023       *
system_u             system_u             s0-s0:c0.c1023       *

<<< No local override stated here, when I log in as "admin" I get system default SELinux user assigned.


When I add a default MLS value (s0), it works:
# echo "*:staff_u:s0" > /etc/selinux/targeted/logins/admin
# semanage login -l

Login Name           SELinux User         MLS/MCS Range        Service

__default__          unconfined_u         s0-s0:c0.c1023       *
root                 unconfined_u         s0-s0:c0.c1023       *
system_u             system_u             s0-s0:c0.c1023       *

Local customization in /etc/selinux/targeted/logins
admin                staff_u              s0                   *

$ ssh admin.client.test
admin.client.test's password: 
Last login: Wed Dec 12 03:20:30 2012 from 10.0.0.1
$ id -Z
staff_u:staff_r:staff_t:s0

Comment 4 Miroslav Grepl 2012-12-12 09:49:32 UTC

Yes, you are right. 

Just to be clear we talk about MCS related to targeted policy where is just one default level - s0.

Basically I would suggest you to add a note where 

staff_u/sysadm_u should have "s0-s0:c0.c1023" range

user_u/guest_u can just run with the default level "s0"

Comment 5 Martin Kosek 2012-12-12 10:09:05 UTC

(In reply to comment #4)
> Yes, you are right. 
> 
> Just to be clear we talk about MCS related to targeted policy where is just
> one default level - s0.
> 
> Basically I would suggest you to add a note where 
> 
> staff_u/sysadm_u should have "s0-s0:c0.c1023" range
> 
> user_u/guest_u can just run with the default level "s0"

Thanks, Mirek! Though I am still not certain what is the resolution of my question. Do I understand it right that we should require at least the default MLS range to be passed? I.e. allow "user_u:s0" to be configured in FreeIPA as a SELinux user and do not allow plain "user_u"?

If this is the case, I think I will just improve our error message with the info you provided...

Comment 6 Miroslav Grepl 2012-12-12 12:22:07 UTC

Yes, "s0" should be required. I believe you should use 

"user_u:s0"

as default option as you wrote.

Comment 7 Martin Kosek 2012-12-12 14:29:40 UTC

I updated the freeipa.org wiki and added an information that at least the default range is required.

As for this Bugzilla, closing as NOTABUG as there is nothing to be done on FreeIPA side. I did not see a place where we would mention that the range is optional. Our examples in help also always use at least the default range.