RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 983639 - R-Studio generated files are not accessible to samba because of default label they get stuck with
Summary: R-Studio generated files are not accessible to samba because of default label...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: selinux-policy
Version: 6.3
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Miroslav Grepl
QA Contact: Milos Malik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-07-11 15:22 UTC by lejeczek
Modified: 2013-11-21 10:45 UTC (History)
3 users (show)

Fixed In Version: selinux-policy-3.7.19-210.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-11-21 10:45:35 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:1598 0 normal SHIPPED_LIVE selinux-policy bug fix and enhancement update 2013-11-20 21:39:24 UTC

Description lejeczek 2013-07-11 15:22:56 UTC 
Description of problem:

R-Studio (server through local httpd proxy - one standard option to run R-Studio server) creates files in user's home directory and these newly created files are labeled:
system_u:object_r:user_home_dir_t:s0

one thing that I know of which has problems with it is samba, clients don't get to see these files

now if user runs R from ssh-bash sessions files are labeled:
unconfined_u:object_r:user_home_t:s0

I yum-updated several packages in one go thus cannot pinpoint where but I believe something must have changed as we had not had this problem before

Version-Release number of selected component (if applicable):

selinux-policy-3.7.19-195.el6_4.12.noarch
selinux-policy-targeted-3.7.19-195.el6_4.12.noarch

How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

would there be a quick-permanent fix? restorecon fixes it but temporarily, naturally.
Comment 1 lejeczek 2013-07-11 15:26:07 UTC 
running process gets labeled:

LABEL                           UID        PID  PPID  C    SZ   RSS PSR STIME TTY          TIME CMD
system_u:system_r:initrc_t:s0   pe243    61205  4292  7 959577 66084  1 16:23 ?        00:00:02 /usr/lib/rstudio-server/bin/rsession -u me
Comment 2 lejeczek 2013-07-11 15:29:25 UTC 
but when manually 

service rstudio-server restart

then

LABEL                           UID        PID  PPID  C    SZ   RSS PSR STIME TTY          TIME CMD
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pe243 61533 61448 10 959572 68196 1 16:27 ? 00:00:02 /usr/lib/rstudio-server/bin/rsession -u pe243
Comment 4 Daniel Walsh 2013-07-16 17:50:35 UTC 
Can you set this up to create files in a subdir of the homedir and set the label correctly.

Miroslav we probably need to make sure initrc_t creating content in user_home_dir_t transitions to user_home_t.
Comment 5 lejeczek 2013-07-17 14:56:02 UTC 
it seems like when rstudio-server gets started by init it's users sessions/process run with
system_u:system_r:initrc_t:s0
this results in
system_u:object_r:user_home_dir_t:s0

whereas if re/started manually these sessions/processes run as
unconfined_u:unconfined_r:unconfined
which results in
unconfined_u:object_r:user_home_t:s0

this unconfined_u makes the difference, at least to samba, with system_u samba does not see the files

should I try to get the authors of RStudio involved?
Comment 6 Miroslav Grepl 2013-07-22 13:24:01 UTC 
(In reply to Daniel Walsh from comment #4)
> Can you set this up to create files in a subdir of the homedir and set the
> label correctly.
> 
> Miroslav we probably need to make sure initrc_t creating content in
> user_home_dir_t transitions to user_home_t.

Yes, we will need to add

#Make sure that home content is created with user_home_t
userdom_user_home_dir_filetrans_pattern(initrc_t, { dir file lnk_file }
Comment 10 errata-xmlrpc 2013-11-21 10:45:35 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1598.html
Note You need to log in before you can comment on or make changes to this bug.