Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 962752

Summary:

sepolicy generate: Errors when running setup script for generated admin_user policy

Product:

Red Hat Enterprise Linux 7

Reporter:

Michal Trunecka <mtruneck>

Component:

policycoreutils

Assignee:

Daniel Walsh <dwalsh>

Status:

CLOSED CURRENTRELEASE

QA Contact:

Michal Trunecka <mtruneck>

Severity:

medium

Docs Contact:

Priority:

medium

Version:

7.0

CC:

ebenes, mgrepl, mmalik

Target Milestone:

Target Release:

---

Hardware:

All

OS:

Linux

Whiteboard:

Fixed In Version:

policycoreutils-2.1.14-63.el7

Doc Type:

Bug Fix

Doc Text:

Story Points:

---

Clone Of:

Environment:

Last Closed:

2013-09-10 12:17:58 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Bug Depends On:

Bug Blocks:

917049

Attachments:

Description	Flags
sepolicy-generate.patch	none

Description Michal Trunecka 2013-05-14 11:41:53 UTC

Description of problem:

Setup script throws
  1) Warnings about deprecated macros
  2) Errors about missing requirements that make the script fail


Policy generated by following command:
   sepolicy generate -n testpolicy --admin_user -a firewalld


Here follows the output of setup script:

# ./testpolicy.sh 
Building and Loading Policy
+ make -f /usr/share/selinux/devel/Makefile testpolicy.pp
Compiling targeted testpolicy module
testpolicy.te:7: Warning: pcscd_manage_pub_files(passwd_t) has been deprecated
testpolicy.te:7: Warning: pcscd_manage_pub_pipes(passwd_t) has been deprecated
/usr/bin/checkmodule:  loading policy configuration from tmp/testpolicy.tmp
/usr/bin/checkmodule:  policy configuration loaded
/usr/bin/checkmodule:  writing binary representation (version 17) to tmp/testpolicy.mod
Creating targeted testpolicy.pp policy package
rm tmp/testpolicy.mod tmp/testpolicy.mod.fc
+ /usr/sbin/semodule -i testpolicy.pp
libsepol.print_missing_requirements: testpolicy's global requirements were not met: bool testpolicy_read_user_files (No such file or directory).
libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory).
/usr/sbin/semodule:  Failed!



Version-Release number of selected component (if applicable):
policycoreutils-2.1.14-40.el7.x86_64

Comment 1 Daniel Walsh 2013-05-16 17:16:00 UTC

Fixed in policycoreutils-2.1.14-44

Comment 2 Michal Trunecka 2013-05-24 08:15:44 UTC

There is still the message about deprecated macro:

testpolicy.te:7: Warning: pcscd_manage_pub_files(passwd_t) has been deprecated
testpolicy.te:7: Warning: pcscd_manage_pub_pipes(passwd_t) has been deprecated

It concerns the following options:

--admin_user  
--dbus  
--desktop_user 
--sandbox  
--term_user 
--x_user

Comment 3 Michal Trunecka 2013-06-14 09:22:02 UTC

libsepol error is back in  policycoreutils-2.1.14-46.2.el7.x86_64

Comment 4 Daniel Walsh 2013-06-18 17:07:37 UTC

   sepolicy generate -n testpolicy --admin_user -a firewalld

really should be

   sepolicy generate -n testpolicy --confined_admin -a firewalld

Comment 5 Daniel Walsh 2013-06-18 17:10:36 UTC

Depracated wanings should be fixed in selinux-policy-3.12.1-53.el7.noarch

Comment 6 Michal Trunecka 2013-06-19 07:18:52 UTC

Ok, I see. Then the following part of sepolicy generate --help message should be removed:

... [ --admin_user -a  ADMIN_DOMAIN | ...

The man page is correct regarding this.

Comment 7 Miroslav Grepl 2013-06-19 09:54:06 UTC

Ok, how about

... [ --admin_user -r  TRANSITIONING_DOMAIN | ...

# sepolicy generate -n testpolicy --admin_user -r wine

which will generate rules for administrative user and 

# cat testpolicy.te

...
...
...

optional_policy(`
    wine_run(testpolicy_t, testpolicy_r)
')

Comment 8 Miroslav Grepl 2013-06-19 09:55:45 UTC

Created attachment 762828 [details]
sepolicy-generate.patch

Comment 9 Daniel Walsh 2013-06-19 14:11:35 UTC

--admin_user -r  TRANSITION_ROLE

Comment 10 Miroslav Grepl 2013-06-19 14:17:12 UTC

(In reply to Daniel Walsh from comment #9)
> --admin_user -r  TRANSITION_ROLE

Better.

Comment 11 Daniel Walsh 2013-06-19 17:30:10 UTC

fixed in policycoreutils-2.1.14-56.el7

Comment 12 Michal Trunecka 2013-06-20 12:36:19 UTC

Yes, it's working fine.

Only last thing, the man page should be altered accordingly (-r option with admin_user).



And a bit off topic not deserving new bug, but the following line is doubled in man page:
       sepolicy generate --inetd [-n NAME] [-w WRITE_PATH ] command
       sepolicy generate --inetd [-n NAME] [-w WRITE_PATH ] command

Comment 13 Daniel Walsh 2013-06-21 12:48:37 UTC

fixed in policycoreutils-2.1.14-57.el7

Comment 14 Michal Trunecka 2013-06-24 13:09:42 UTC

There is still the old way in man page (policycoreutils-2.1.14-59.el7.x86_64):
       sepolicy generate --admin_user [-a ADMIN_ROLE] -n NAME

Comment 15 Daniel Walsh 2013-06-27 14:09:39 UTC

rpm -q policycoreutils
policycoreutils-2.1.14-59.fc20.x86_64

I don't see this with the rawhide package.

man sepolicy-generate | grep admin_user
       sepolicy generate --admin_user -n NAME
       --admin_user

Comment 16 Michal Trunecka 2013-06-27 14:27:00 UTC

That is interesting then. To be sure, I erased and reinstalled the policycoreutils-python and -devel packages, but still:

# rpm -q policycoreutils
policycoreutils-2.1.14-60.el7.x86_64

# man sepolicy-generate | grep admin_user
       sepolicy generate --admin_user [-a ADMIN_ROLE] -n NAME
       --admin_user

Comment 17 Daniel Walsh 2013-07-11 19:18:59 UTC

fixed in policycoreutils-2.1.14-63.el7

Comment 18 Michal Trunecka 2013-07-16 11:12:49 UTC

I really regret to annoy you with this again.

# rpm -q policycoreutils
policycoreutils-2.1.14-63.el7.x86_64

# man sepolicy-generate | grep admin_user
       sepolicy generate --admin_user [-a TRANSITION_ROLE] -n NAME

Here it should be -r, not -a  ----------^

Comment 19 Miroslav Grepl 2013-09-10 12:17:58 UTC

$ man sepolicy-generate | grep admin_user
       sepolicy generate --admin_user [-r TRANSITION_ROLE] -n NAME
       --admin_user