Re: restorecon ignoring my policy
David Sastre Medina via selinux <[email protected]> Sun, 29 Dec 2024 14:45:40 +0100
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Message-ID | <CAMfsiJF9Ex3b89ouqJx4XSVJ1hovjPCZSGTgqVsDP7wYWgWRzQ@mail.gmail.com> |
--===============3513703696669459743==
Content-Type: multipart/alternative; boundary="0000000000008b740c062a68eb5c"
--0000000000008b740c062a68eb5c
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Seems to be a problem with a substitution alias.
Contexts potentially affected:
```
$ rg ^/usr/sbin /etc/selinux/targeted/contexts/files/file_contexts
4104:/usr/sbin/tlshd -- system_u:object_r:ktlshd_exec_t:s0
4304:/usr/sbin/nbdkit -- system_u:object_r:nbdkit_exec_t:s0
4305:/usr/sbin/smartd -- system_u:object_r:fsdaemon_exec_t:s0
5663:/usr/sbin/rhel-push-plugin --
system_u:object_r:container_runtime_exec_t:s0
5749:/usr/sbin/pcm-sensor-server --
system_u:object_r:pcmsensor_exec_t:s0
```
And the culprit would be an aliasing rule:
```
$ rg bin /etc/selinux/targeted/contexts/files/file_contexts.subs_dist
29:/sbin /usr/bin
33:/bin /usr/bin
34:/usr/sbin /usr/bin # <-----------
```
According to selabel_file(5):
Substitution File Format
Each line within the substitution files (.subs and .subs_dist) has
the form:
subs_pathname pathname
Where:
pathname
A path that matches an entry in one or more of the
file contexts policy configuration file.
subs_pathname
The path that will be aliased (considered equivalent)
with pathname by the look up process.
Example:
# ./contexts/files/file_contexts.subs
# pathname subs_pathname
/myweb /var/www
/myspool /var/spool/mail
Using the above example, when selabel_lookup(3) is passed a
path of /myweb/index.html the function will substitute the /myweb componen=
t
with /var/www, therefore the path used is:
/var/www/index.html
Assuming (I haven't checked, I could be wrong) `restorecon` uses labels
returned by `selabel_lookup`, it makes sense it thinks the context is
correct.
On Sat, Dec 28, 2024 at 2:28=E2=80=AFPM Sam Varshavchik via selinux <
[email protected]> wrote:
> > Something happened with the most recent selinux update in F41, breaking
> my
> > local policy.
> >
> > [root@jack ~]# semanage fcontext -l | grep httportmapd
> > /usr/sbin/httportmapd regular file
> > system_u:object_r:libcxx_httportmapd_exec_t:s0
> >
> > This is coming from a local policy module I cobbled together and
> installed,
> > yet:
> >
> > [root@jack ~]# ls -alZ /usr/sbin/httportmapd
> > -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 318104 Sep 21 2018
> > /usr/sbin/httportmapd
> >
> > And restorecon -F /usr/sbin/httportmapd does not fix the context, and
> stays
> > silent no matter how many -v options I feed to it.
> >
> > Any idea why my file context is not being used?
>
> This looks like a bigger issue, and not just with my module.
>
> There's another explicit file context set for /usr/sbin/smartd. semanage
> says:
>
> /usr/sbin/smartd regular file
> system_u:object_r:fsdaemon_exec_t:s0
>
> However:
>
> [root@jack ~]# ls -alZ /usr/sbin/smartd
> -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 671608 Jul 19 20:00
> /usr/sbin/smartd
>
> And restorecon thinks this is peachy.
>
> I note that semanage fcontext lists, separately:
>
> /usr/sbin =3D /usr/bin
>
> Not sure if this is related, or not. I do see stuff in /usr/sbin with
> other
> labels, namely /usr/sbin/xl2tpd. I don't see how it's set, this does not
> appear in the output of semanage fcontext.
>
> --
> _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[email protected]=
.org
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>
--0000000000008b740c062a68eb5c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div><br></div><div>Seems to be a problem with a substitut=
ion alias.</div><div>Contexts potentially affected:</div><div><br></div><di=
v>```</div><div>$ rg ^/usr/sbin /etc/selinux/targeted/contexts/files/file_c=
ontexts<br>4104:/usr/sbin/tlshd =C2=A0 =C2=A0-- =C2=A0 =C2=A0 =C2=A0system_=
u:object_r:ktlshd_exec_t:s0<br>4304:/usr/sbin/nbdkit =C2=A0 -- =C2=A0 =C2=
=A0 =C2=A0system_u:object_r:nbdkit_exec_t:s0<br>4305:/usr/sbin/smartd =C2=
=A0 -- =C2=A0 =C2=A0 =C2=A0system_u:object_r:fsdaemon_exec_t:s0<br>5663:/us=
r/sbin/rhel-push-plugin -- =C2=A0 =C2=A0 =C2=A0system_u:object_r:container_=
runtime_exec_t:s0<br>5749:/usr/sbin/pcm-sensor-server =C2=A0 =C2=A0 =C2=A0 =
=C2=A0-- =C2=A0 =C2=A0 =C2=A0system_u:object_r:pcmsensor_exec_t:s0<br></div=
><div>```<br></div><div><br></div><div>And the culprit would be an aliasing=
rule:<br></div><div><br></div><div>```</div><div>$ rg bin /etc/selinux/tar=
geted/contexts/files/file_contexts.subs_dist<br>29:/sbin =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/usr/bin<br>33:/bin =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 /usr/bin<br>34:/usr/sbin =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/usr/bin # <-----------<br></div><div>```=
<br></div><div><br></div><div>According to selabel_file(5):</div><div><br><=
/div><div>Substitution File Format<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0Each line =
within the substitution files (.subs and .subs_dist) has the form:<br>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 subs_pathname pathname<br><br=
>=C2=A0 =C2=A0 =C2=A0 =C2=A0Where:<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 pathname<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0A path that matches an entry in one or more of t=
he file contexts policy configuration file.<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 subs_pathname<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0The path that will be aliased (con=
sidered equivalent) with pathname by the look up process.<br><br>=C2=A0 =C2=
=A0 =C2=A0 =C2=A0Example:<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 # ./contexts/files/file_contexts.subs<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 # pathname =C2=A0subs_pathname<br>=C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 /myweb =C2=A0 =C2=A0 =C2=A0/var/www<br>=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 /myspool =C2=A0 =C2=A0/var/spool/=
mail<br><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Using the abov=
e example, when selabel_lookup(3) is passed a path of /myweb/index.html the=
function will substitute the /myweb =C2=A0component<br>=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 with /var/www, therefore the path used is:<=
br><br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0/var/www/index.html<br></div><div><br></div><div>Assuming (I have=
n't checked, I could be wrong) `restorecon` uses labels returned by `se=
label_lookup`, it makes sense it thinks the context is correct.</div><div><=
br></div></div><br><div class=3D"gmail_quote gmail_quote_container"><div di=
r=3D"ltr" class=3D"gmail_attr">On Sat, Dec 28, 2024 at 2:28=E2=80=AFPM Sam =
Varshavchik via selinux <<a href=3D"mailto:[email protected]=
rg">[email protected]</a>> wrote:<br></div><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid =
rgb(204,204,204);padding-left:1ex">> Something happened with the most re=
cent selinux update in F41, breaking my=C2=A0 <br>
> local policy.<br>
><br>
> [root@jack ~]# semanage fcontext -l | grep httportmapd<br>
> /usr/sbin/httportmapd=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 regular file=C2=A0 =
=C2=A0 =C2=A0 =C2=A0 <br>
> system_u:object_r:libcxx_httportmapd_exec_t:s0<br>
><br>
> This is coming from a local policy module I cobbled together and insta=
lled,=C2=A0 <br>
> yet:<br>
><br>
> [root@jack ~]# ls -alZ /usr/sbin/httportmapd<br>
> -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 318104 Sep 21=C2=A0=
2018=C2=A0 <br>
> /usr/sbin/httportmapd<br>
><br>
> And restorecon -F /usr/sbin/httportmapd does not fix the context, and =
stays=C2=A0 <br>
> silent no matter how many -v options I feed to it.<br>
><br>
> Any idea why my file context is not being used?<br>
<br>
This looks like a bigger issue, and not just with my module.<br>
<br>
There's another explicit file context set for /usr/sbin/smartd. semanag=
e=C2=A0 <br>
says:<br>
<br>
/usr/sbin/smartd=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0regular f=
ile=C2=A0 =C2=A0 =C2=A0 =C2=A0system_u:object_r:fsdaemon_exec_t:s0<br>
<br>
However:<br>
<br>
[root@jack ~]# ls -alZ /usr/sbin/smartd<br>
-rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 671608 Jul 19 20:00 /usr=
/sbin/smartd<br>
<br>
And restorecon thinks this is peachy.<br>
<br>
I note that semanage fcontext lists, separately:<br>
<br>
/usr/sbin =3D /usr/bin<br>
<br>
Not sure if this is related, or not. I do see stuff in /usr/sbin with other=
=C2=A0 <br>
labels, namely /usr/sbin/xl2tpd. I don't see how it's set, this doe=
s not=C2=A0 <br>
appear in the output of semanage fcontext.<br>
<br>
-- <br>
_______________________________________________<br>
selinux mailing list -- <a href=3D"mailto:[email protected]" =
target=3D"_blank">[email protected]</a><br>
To unsubscribe send an email to <a href=3D"mailto:[email protected]=
aproject.org" target=3D"_blank">[email protected]</a><b=
r>
Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro=
ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe=
doraproject.org/en-US/project/code-of-conduct/</a><br>
List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui=
delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik=
i/Mailing_list_guidelines</a><br>
List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel=
[email protected]" rel=3D"noreferrer" target=3D"_blank">https://=
lists.fedoraproject.org/archives/list/[email protected]</a><b=
r>
Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras=
tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/=
fedora-infrastructure/new_issue</a><br>
</blockquote></div>
--0000000000008b740c062a68eb5c--
--===============3513703696669459743==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu
dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z
dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl
Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0
Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw
czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB
cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl
bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y
dCBpdDogaHR0cHM6Ly9wYWd1cmUuaW8vZmVkb3JhLWluZnJhc3RydWN0dXJlL25ld19pc3N1ZQo=
--===============3513703696669459743==--