Fedora Account System
Red Hat Associate
Red Hat Customer
Description: ============ openswan has the correct fcontexts set, but strongswan is missing a few. The current contexts for openswan: /etc/ipsec\.conf regular file system_u:object_r:ipsec_conf_file_t:s0 /etc/ipsec\.d(/.*)? all files system_u:object_r:ipsec_key_file_t:s0 /etc/ipsec\.d/examples(/.*)? all files system_u:object_r:etc_t:s0 /etc/ipsec\.secrets.* regular file system_u:object_r:ipsec_key_file_t:s0 /etc/rc\.d/init\.d/ipsec regular file system_u:object_r:ipsec_initrc_exec_t:s0 /var/lock/subsys/ipsec regular file system_u:object_r:ipsec_mgmt_lock_t:s0 However, the /etc/strongswan/ipsec.d/ directory only has this: /etc/strongswan(/.*)? all files system_u:object_r:ipsec_conf_file_t:s0 Solution: ========= The /etc/strongswan/ipsec.d/ directory should mirror the contexts above, so it looks like this: /etc/strongswan/ipsec\.conf regular file system_u:object_r:ipsec_conf_file_t:s0 /etc/strongswan/ipsec\.d(/.*)? all files system_u:object_r:ipsec_key_file_t:s0 /etc/strongswan/ipsec\.d/examples(/.*)? all files system_u:object_r:etc_t:s0 /etc/strongswan/ipsec\.secrets.* regular file system_u:object_r:ipsec_key_file_t:s0 /etc/rc\.d/init\.d/strongswan regular file system_u:object_r:ipsec_initrc_exec_t:s0 /var/lock/subsys/strongswan regular file system_u:object_r:ipsec_mgmt_lock_t:s0 Version-Release number of selected component (if applicable): Could you please fix this on rawhide, f19, f18 and el6? Thanks!
Added. commit 797d28d0dd8a6010078aab159aacfa64acb96b29 Author: Miroslav Grepl <mgrepl> Date: Tue Jul 16 10:36:28 2013 +0200 Add additional labeling for strongswan
Thanks! I forgot to mention that on EL6, it's also missing this one (in addition to all of the above mentioned): /usr/sbin/strongswan regular file system_u:object_r:ipsec_mgmt_exec_t:s0
This bug appears to have been reported against 'rawhide' during the Fedora 20 development cycle. Changing version to '20'. More information and reason for this action is here: https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora20
selinux-policy-3.12.1-83.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-83.fc20
Package selinux-policy-3.12.1-83.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-83.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-17722/selinux-policy-3.12.1-83.fc20 then log in and leave karma (feedback).
Package selinux-policy-3.12.1-84.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-84.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-17722/selinux-policy-3.12.1-84.fc20 then log in and leave karma (feedback).