Re: restorecon ignoring my policy
David Sastre Medina via selinux <[email protected]> Sun, 29 Dec 2024 19:28:33 +0100
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Message-ID | <CAMfsiJGHc9nY9bzSyWjRFYyDY2e-vooTNrif3qp1tEc2qezAOQ@mail.gmail.com> |
--===============2229608555031734841== Content-Type: multipart/alternative; boundary="0000000000002a0466062a6cdfd4" --0000000000002a0466062a6cdfd4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I didn't mean to imply that `restorecon` has changed, rather that it's working as expected. I think the /usr/sbin -> /usr/bin addition to file_contexts.subs_dist is related to https://discussion.fedoraproject.org/t/f40-change-proposal-unify-usr-bin-an= d-usr-sbin-system-wide/99853 Reading the changelog of the selinux-policy RPM, you can read that: - Alias /usr/sbin to /usr/bin and change all /usr/sbin paths to /usr/bin was implemented in 41.4-1. Depending on which version you upgraded from, that may be proof. Adding "fake" labels for files installed under `/usr/sbin` using `/usr/bin` in the file contexts is just hiding the problem. On Sun, Dec 29, 2024 at 5:44=E2=80=AFPM Sam Varshavchik via selinux < [email protected]> wrote: > David Sastre Medina via selinux writes: > > > Contexts potentially affected: > > > > > > ``` > > $ rg ^/usr/sbin /etc/selinux/targeted/contexts/files/file_contexts > > 4104:/usr/sbin/tlshd -- system_u:object_r:ktlshd_exec_t:s0 > > 4304:/usr/sbin/nbdkit -- system_u:object_r:nbdkit_exec_t:s0 > > 4305:/usr/sbin/smartd -- system_u:object_r:fsdaemon_exec_t:s0 > > 5663:/usr/sbin/rhel-push-plugin -- > > system_u:object_r:container_runtime_exec_t:s0 > > 5749:/usr/sbin/pcm-sensor-server -- > > system_u:object_r:pcmsensor_exec_t:s0 > > > > ``` > > > > > > > > And the culprit would be an aliasing rule: > > > > > > > > ``` > > $ rg bin /etc/selinux/targeted/contexts/files/file_contexts.subs_dist > > 29:/sbin /usr/bin > > 33:/bin /usr/bin > > 34:/usr/sbin /usr/bin # <----------- > > > Assuming (I haven't checked, I could be wrong) `restorecon` uses labels > > returned by `selabel_lookup`, it makes sense it thinks the context is > > correct. > > Something other than restorecon got changed. I did not start getting AVCs > until I installed a week's worth of updates. > > dnf history shows that I installed version 0:41.27-1 of selinux policy > packages. I had no issues prior to installing this update. > > It appears that many packages are already aware of this =E2=80=A6feature.= The > abrt- > dbus package, for example, installs /usr/sbin/abrt-dbus, but includes a > label for: > > [root@jack ~]# semanage fcontext --list | grep abrt_exec_t > /usr/bin/abrt-dbus regular file > system_u:object_r:abrt_exec_t:s0 > > This is very confusing. > -- > _______________________________________________ > selinux mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/[email protected]= .org > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > --0000000000002a0466062a6cdfd4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>I didn't mean to imply that `restorecon` has chan= ged, rather that it's working as expected.</div><div><br></div><div>I t= hink the /usr/sbin -> /usr/bin addition to file_contexts.subs_dist is re= lated to <a href=3D"https://discussion.fedoraproject.org/t/f40-change-propo= sal-unify-usr-bin-and-usr-sbin-system-wide/99853">https://discussion.fedora= project.org/t/f40-change-proposal-unify-usr-bin-and-usr-sbin-system-wide/99= 853</a></div><div></div><div><div><br></div><div>Reading the changelog of t= he selinux-policy RPM, you can read that:</div><div>- Alias /usr/sbin to /u= sr/bin and change all /usr/sbin paths to /usr/bin =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 <br></div><div>was implemented in 41.4-1. Depen= ding on which version you upgraded from, that may be proof.</div><div><br><= /div><div><div>Adding "fake" labels for files installed under `/u= sr/sbin` using `/usr/bin` in the file contexts is just hiding the problem.<= /div><div><br></div></div></div></div><br><div class=3D"gmail_quote"><div d= ir=3D"ltr" class=3D"gmail_attr">On Sun, Dec 29, 2024 at 5:44=E2=80=AFPM Sam= Varshavchik via selinux <<a href=3D"mailto:[email protected].= org" target=3D"_blank">[email protected]</a>> wrote:<br></= div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor= der-left:1px solid rgb(204,204,204);padding-left:1ex">David Sastre Medina v= ia selinux writes:<br> <br> > Contexts potentially affected:<br> ><br> ><br> > ```<br> > $ rg ^/usr/sbin /etc/selinux/targeted/contexts/files/file_contexts<br> > 4104:/usr/sbin/tlshd =C2=A0 =C2=A0-- =C2=A0 =C2=A0 =C2=A0system_u:obje= ct_r:ktlshd_exec_t:s0<br> > 4304:/usr/sbin/nbdkit =C2=A0 -- =C2=A0 =C2=A0 =C2=A0system_u:object_r:= nbdkit_exec_t:s0<br> > 4305:/usr/sbin/smartd =C2=A0 -- =C2=A0 =C2=A0 =C2=A0system_u:object_r:= fsdaemon_exec_t:s0<br> > 5663:/usr/sbin/rhel-push-plugin -- =C2=A0 =C2=A0=C2=A0 <br> > =C2=A0system_u:object_r:container_runtime_exec_t:s0<br> > 5749:/usr/sbin/pcm-sensor-server =C2=A0 =C2=A0 =C2=A0 =C2=A0-- =C2=A0 = =C2=A0=C2=A0 <br> > =C2=A0system_u:object_r:pcmsensor_exec_t:s0<br> ><br> > ```<br> ><br> ><br> ><br> > And the culprit would be an aliasing rule:<br> ><br> ><br> ><br> > ```<br> > $ rg bin /etc/selinux/targeted/contexts/files/file_contexts.subs_dist<= br> > 29:/sbin =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/usr/b= in<br> > 33:/bin =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 /usr/b= in<br> > 34:/usr/sbin =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/usr/bin # <-= ----------<br> <br> > Assuming (I haven't checked, I could be wrong) `restorecon` uses l= abels=C2=A0 <br> > returned by `selabel_lookup`, it makes sense it thinks the context is= =C2=A0 <br> > correct.<br> <br> Something other than restorecon got changed. I did not start getting AVCs= =C2=A0 <br> until I installed a week's worth of updates.<br> <br> dnf history shows that I installed version 0:41.27-1 of selinux policy=C2= =A0 <br> packages. I had no issues prior to installing this update.<br> <br> It appears that many packages are already aware of this =E2=80=A6feature. T= he abrt- <br> dbus package, for example, installs /usr/sbin/abrt-dbus, but includes a=C2= =A0 <br> label for:<br> <br> [root@jack ~]# semanage fcontext --list | grep abrt_exec_t<br> /usr/bin/abrt-dbus=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0regular file= =C2=A0 =C2=A0 =C2=A0 =C2=A0system_u:object_r:abrt_exec_t:s0<br> <br> This is very confusing.<br> -- <br> _______________________________________________<br> selinux mailing list -- <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br> To unsubscribe send an email to <a href=3D"mailto:[email protected]= aproject.org" target=3D"_blank">[email protected]</a><b= r> Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro= ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe= doraproject.org/en-US/project/code-of-conduct/</a><br> List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui= delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik= i/Mailing_list_guidelines</a><br> List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel= [email protected]" rel=3D"noreferrer" target=3D"_blank">https://= lists.fedoraproject.org/archives/list/[email protected]</a><b= r> Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras= tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/= fedora-infrastructure/new_issue</a><br> </blockquote></div> --0000000000002a0466062a6cdfd4-- --===============2229608555031734841== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0 Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y dCBpdDogaHR0cHM6Ly9wYWd1cmUuaW8vZmVkb3JhLWluZnJhc3RydWN0dXJlL25ld19pc3N1ZQo= --===============2229608555031734841==--