RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 906825 - SELinux drops an error after sendmail installation by yum-builddep
Summary: SELinux drops an error after sendmail installation by yum-builddep
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.0
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On: 906773
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-02-01 15:30 UTC by Aleš Mareček
Modified: 2013-06-24 18:58 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: 906773
Environment:
Last Closed: 2013-06-24 18:58:15 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Aleš Mareček 2013-02-01 15:30:39 UTC 
+++ This bug was initially created as a clone of Bug #906773 +++

Description of problem:
SELinux drop error after sendmail installation by yum-builddep.
NOTE: This might be a problem of sendmail, not selinux-policy.

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-192.el6.noarch
sendmail-8.14.4-8.el6

How reproducible:
Always

Steps to Reproduce:
1. Be sure that sendmail is not installed
2. Download some source package that has dependency to sendmail.
3. yum-builddep <downloaded-source-package> (I used sudo package)
4. ausearch -m SELINUX_ERR -ts recent

Expected:
<no matches>

LOG:
i:i386|m:i686 root@intel-piketon-02 [tmp]# id smmsp
id: smmsp: No such user
i:i386|m:i686 root@intel-piketon-02 [tmp]# ausearch -m SELINUX_ERR -ts recent
<no matches>
i:i386|m:i686 root@intel-piketon-02 [tmp]# yum-builddep sudo-1.8.6p3-6.el6.src.rpm 
Loaded plugins: product-id
Getting requirements for sudo-1.8.6p3-6.el6.src
 --> Already installed : pam-devel-1.1.1-13.el6.i686
 --> Already installed : groff-1.18.1.4-21.el6.i686
 --> Already installed : openldap-devel-2.4.23-31.el6.i686
 --> Already installed : flex-2.5.35-8.el6.i686
 --> Already installed : bison-2.4.1-5.el6.i686
 --> Already installed : automake-1.11.1-4.el6.noarch
 --> Already installed : autoconf-2.63-5.1.el6.noarch
 --> Already installed : libtool-2.2.6-15.5.el6.i686
 --> Already installed : audit-libs-devel-2.2-2.el6.i686
 --> Already installed : libcap-devel-2.16-5.5.el6.i686
 --> Already installed : libselinux-devel-2.0.94-5.3.el6.i686
 --> sendmail-8.14.4-8.el6.i686
--> Running transaction check
---> Package sendmail.i686 0:8.14.4-8.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

============================================================================================================================================================================================================================================
 Package                                                 Arch                                                Version                                                     Repository                                                    Size
============================================================================================================================================================================================================================================
Installing:
 sendmail                                                i686                                                8.14.4-8.el6                                                beaker-Client                                                713 k

Transaction Summary
============================================================================================================================================================================================================================================
Install       1 Package(s)

Total download size: 713 k
Installed size: 1.5 M
Is this ok [y/N]: y
Downloading Packages:
sendmail-8.14.4-8.el6.i686.rpm                                                                                                                                                                                       | 713 kB     00:00     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : sendmail-8.14.4-8.el6.i686                                                                                                                                                                                               1/1 
warning: group smmsp does not exist - using root
warning: user smmsp does not exist - using root
warning: group smmsp does not exist - using root
  Verifying  : sendmail-8.14.4-8.el6.i686                                                                                                                                                                                               1/1 

Installed:
  sendmail.i686 0:8.14.4-8.el6                                                                                                                                                                                                              

Complete!
i:i386|m:i686 root@intel-piketon-02 [tmp]# ausearch -m SELINUX_ERR -ts recent
----
time->Fri Feb  1 07:53:04 2013
type=SYSCALL msg=audit(1359723184.630:86): arch=40000003 syscall=11 success=no exit=-13 a0=83891d0 a1=83874e0 a2=8387708 a3=83874e0 items=0 ppid=9145 pid=9149 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 key=(null)
type=SELINUX_ERR msg=audit(1359723184.630:86): security_compute_sid:  invalid context unconfined_u:unconfined_r:groupadd_t:s0-s0:c0.c1023 for scontext=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 tcontext=system_u:object_r:groupadd_exec_t:s0 tclass=process
----
time->Fri Feb  1 07:53:04 2013
type=SYSCALL msg=audit(1359723184.632:87): arch=40000003 syscall=11 success=no exit=-13 a0=8389248 a1=8388a20 a2=8387708 a3=8388a20 items=0 ppid=9145 pid=9151 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="sh" exe="/bin/bash" subj=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 key=(null)
type=SELINUX_ERR msg=audit(1359723184.632:87): security_compute_sid:  invalid context unconfined_u:unconfined_r:useradd_t:s0-s0:c0.c1023 for scontext=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 tcontext=system_u:object_r:useradd_exec_t:s0 tclass=process
----
time->Fri Feb  1 07:53:05 2013
type=SYSCALL msg=audit(1359723185.769:88): arch=40000003 syscall=11 success=no exit=-13 a0=853e130 a1=853dfa8 a2=85367a0 a3=853dfa8 items=0 ppid=9163 pid=9165 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="make" exe="/bin/bash" subj=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 key=(null)
type=SELINUX_ERR msg=audit(1359723185.769:88): security_compute_sid:  invalid context unconfined_u:unconfined_r:system_mail_t:s0-s0:c0.c1023 for scontext=unconfined_u:unconfined_r:rpm_script_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=process


i:i386|m:i686 root@intel-piketon-02 [tmp]# rpm -q selinux-policy sendmail
selinux-policy-3.7.19-192.el6.noarch
sendmail-8.14.4-8.el6.i686


Additional info:
Installation using yum doesn't raise the error, log:
i:i386|m:i686 root@intel-piketon-02 [tmp]# date
Fri Feb  1 07:59:06 EST 2013
i:i386|m:i686 root@intel-piketon-02 [tmp]# ausearch -m SELINUX_ERR -ts 7:59
<no matches>
i:i386|m:i686 root@intel-piketon-02 [tmp]# yum -y install sendmail
Loaded plugins: product-id, security, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package sendmail.i686 0:8.14.4-8.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

============================================================================================================================================================================================================================================
 Package                                                 Arch                                                Version                                                     Repository                                                    Size
============================================================================================================================================================================================================================================
Installing:
 sendmail                                                i686                                                8.14.4-8.el6                                                beaker-Client                                                713 k

Transaction Summary
============================================================================================================================================================================================================================================
Install       1 Package(s)

Total download size: 713 k
Installed size: 1.5 M
Downloading Packages:
sendmail-8.14.4-8.el6.i686.rpm                                                                                                                                                                                       | 713 kB     00:00     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : sendmail-8.14.4-8.el6.i686                                                                                                                                                                                               1/1 
  Verifying  : sendmail-8.14.4-8.el6.i686                                                                                                                                                                                               1/1 

Installed:
  sendmail.i686 0:8.14.4-8.el6                                                                                                                                                                                                              

Complete!
i:i386|m:i686 root@intel-piketon-02 [tmp]# ausearch -m SELINUX_ERR -ts 7:59
<no matches>

--- Additional comment from Daniel Walsh on 2013-02-01 09:02:59 EST ---

The problem is do to /bin/yum-builddep 
 not being labeled as rpm_exec_t.

But it does point out other issues, basically that we end up with rpm_script_t running as unconfined_u:unconfined_r:rpm_script_t, where we expected this to run as system_r:rpm_script_t.

--- Additional comment from Daniel Walsh on 2013-02-01 09:16:35 EST ---

e93cdb12c640ae87e11672ed2af67835cd6f82bc fixes this for RHEL7 as far as making sure proper role handling happens.

But for RHEL6 we just need to relabel yum command.

--- Additional comment from Daniel Walsh on 2013-02-01 09:17:11 EST ---

chcon -t rpm_exec_t  /usr/bin/yum-builddep

Should fix this for now.
Comment 1 Miroslav Grepl 2013-02-01 16:53:57 UTC 
Dan added fixes to F19. We will use F19 policy also in RHEL7 which will fix this issue.
Note You need to log in before you can comment on or make changes to this bug.