Re: restorecon ignoring my policy
David Sastre Medina via selinux <[email protected]> Thu, 9 Jan 2025 19:27:33 +0100
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Message-ID | <CAMfsiJEvG_xVDkYT-MdQ6iy=X0z6bDWs77nRzTe4Qk17nthdUQ@mail.gmail.com> |
--===============8346210119936682068== Content-Type: multipart/alternative; boundary="000000000000ef6c94062b4a238f" --000000000000ef6c94062b4a238f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello Zdenek, There are a few executables that are not being properly labelled, and restorecon does not correct it. I don't have any custom policy installed in this system. This is one example: $ sudo semanage fcontext -l | rg /usr/sbin/smartd /usr/sbin/smartd regular file system_u:object_r:fsdaemon_exec_t:s0 $ ls -lZ /usr/sbin/smartd -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 671608 Jul 20 02:00 /usr/sbin/smartd $ sudo restorecon -v /usr/sbin/smartd $ ls -lZ /usr/sbin/smartd -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 671608 Jul 20 02:00 /usr/sbin/smartd The other executables potentially affected by the same problem (I cannot check, I don't have any of them installed), are: $ sudo semanage fcontext -l | rg /usr/sbin/ /usr/sbin/nbdkit regular file system_u:object_r:nbdkit_exec_t:s0 /usr/sbin/pcm-sensor-server regular file system_u:object_r:pcmsensor_exec_t:s0 /usr/sbin/rhel-push-plugin regular file system_u:object_r:container_runtime_exec_t:s0 /usr/sbin/smartd regular file system_u:object_r:fsdaemon_exec_t:s0 /usr/sbin/tlshd regular file system_u:object_r:ktlshd_exec_t:s0 Let me know if you need a bug opened for this, and where (GitHub, BZ, ...) Regards. On Thu, Jan 9, 2025 at 6:57=E2=80=AFPM Zdenek Pytela via selinux < [email protected]> wrote: > > > On Fri, Jan 3, 2025 at 6:01=E2=80=AFPM Sam Varshavchik via selinux < > [email protected]> wrote: > >> Zdenek Pytela writes: >> >> > Anyway, the long term solution is to change the entries to use /usr/bi= n. >> >> So, right now: >> >> 1. A package installs stuff in /usr/sbin >> 2. It installs an selinux policy file referencing filenames in /usr/bin >> >> Am I the only one who has =E2=80=A6questions, here? >> > Firstly, there is an equivalency supporting the change: > > f42# semanage fcontext -l | grep /usr/sbin.=3D > /usr/sbin =3D /usr/bin > f42# ls -Z /usr/sbin/sshd > system_u:object_r:sshd_exec_t:s0 /usr/sbin/sshd > f42# matchpathcon /usr/sbin/sshd > /usr/sbin/sshd system_u:object_r:sshd_exec_t:s0 > > Equivalency is a feature to substitute one path in the policy with anothe= r. > Secondly, there is a script to take care of all entries referring to > /usr/sbin, e. g. from a local policy module. Feel free to file a bug repo= rt > if an improvement is needed. > > > >> -- >> _______________________________________________ >> selinux mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedoraproject.org/archives/list/[email protected]= t.org >> Do not reply to spam, report it: >> https://pagure.io/fedora-infrastructure/new_issue >> > > > -- > > Zdenek Pytela > Security SELinux team > -- > _______________________________________________ > selinux mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/[email protected]= .org > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > --000000000000ef6c94062b4a238f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div>Hello Zdenek,</div><div><br></div><div>There are a fe= w executables that are not being properly labelled, and restorecon does not= correct it.</div><div>I don't have any custom policy installed in this= system.<br></div><div>This is one example:</div><div><br></div><div>$ sudo= semanage fcontext -l | rg /usr/sbin/smartd<br>/usr/sbin/smartd =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 regular file =C2=A0 =C2=A0 =C2=A0 system= _u:object_r:fsdaemon_exec_t:s0 <br>$ ls -lZ /usr/sbin/smartd<br>-rwxr-xr-x.= 1 root root system_u:object_r:bin_t:s0 671608 Jul 20 02:00 /usr/sbin/smart= d<br></div><div></div><div><br></div><div>$ sudo restorecon -v /usr/sbin/sm= artd<br>$ ls -lZ /usr/sbin/smartd<br>-rwxr-xr-x. 1 root root system_u:objec= t_r:bin_t:s0 671608 Jul 20 02:00 /usr/sbin/smartd</div><div><br></div><div>= The other executables potentially affected by the same problem (I cannot ch= eck, I don't have any of them installed), are:</div><div><br></div><div= >$ sudo semanage fcontext -l | rg /usr/sbin/</div><div>/usr/sbin/nbdkit =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 regular file =C2=A0 =C2=A0 =C2=A0= system_u:object_r:nbdkit_exec_t:s0 <br>/usr/sbin/pcm-sensor-server =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0regular file =C2=A0 =C2=A0 =C2=A0 system_u:object_r:pcmsensor_exec_t:s0 = <br>/usr/sbin/rhel-push-plugin =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 regular file =C2=A0 =C2=A0 =C2=A0= system_u:object_r:container_runtime_exec_t:s0 <br>/usr/sbin/smartd =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 regular file =C2=A0 =C2=A0 =C2=A0 sy= stem_u:object_r:fsdaemon_exec_t:s0 <br>/usr/sbin/tlshd =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0regular file =C2=A0 =C2=A0 =C2=A0 system_u:o= bject_r:ktlshd_exec_t:s0</div><div><br></div><div></div><div>Let me know if= you need a bug opened for this, and where (GitHub, BZ, ...)<br></div><div>= <br></div><div>Regards.<br></div><div><br></div></div><br><div class=3D"gma= il_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Th= u, Jan 9, 2025 at 6:57=E2=80=AFPM Zdenek Pytela via selinux <<a href=3D"= mailto:[email protected]">[email protected]</a>= > wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px = 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div= dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote"><div= dir=3D"ltr" class=3D"gmail_attr">On Fri, Jan 3, 2025 at 6:01=E2=80=AFPM Sa= m Varshavchik via selinux <<a href=3D"mailto:[email protected]= .org" target=3D"_blank">[email protected]</a>> wrote:<br><= /div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bo= rder-left:1px solid rgb(204,204,204);padding-left:1ex">Zdenek Pytela writes= :<br> <br> > Anyway, the long term solution is to change the entries to use /usr/bi= n.<br> <br> So, right now:<br> <br> 1. A package installs stuff in /usr/sbin<br> 2. It installs an selinux policy file referencing filenames in /usr/bin<br> <br> Am I the only one who has =E2=80=A6questions, here?<br></blockquote><div>Fi= rstly, there is an equivalency supporting the change:<br></div><div><span s= tyle=3D"font-family:monospace"><span style=3D"color:rgb(0,0,0);background-c= olor:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">f42# semanage fcontext -l | grep /usr/sbin.=3D</span><span style=3D"colo= r:rgb(0,0,0);background-color:rgb(255,255,255)"> </span><br><span style=3D"font-weight:bold;color:rgb(255,84,84);background-= color:rgb(255,255,255)">/usr/sbin =3D</span><span style=3D"color:rgb(0,0,0)= ;background-color:rgb(255,255,255)"> /usr/bin</span><span style=3D"color:rg= b(0,0,0);background-color:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">f42# ls -Z /usr/sbin/sshd</span><span style=3D"color:rgb(0,0,0);backgrou= nd-color:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">system_u:object_r:sshd_exec_t:s0 </span><span style=3D"font-weight:bold;= color:rgb(84,255,84);background-color:rgb(255,255,255)">/usr/sbin/sshd</spa= n><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">f42# </span><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255= ,255)">matchpathcon /usr/sbin/sshd</span><span style=3D"color:rgb(0,0,0);ba= ckground-color:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">/usr/sbin/sshd</span><span style=3D"color:rgb(0,0,0);background-color:rg= b(255,255,255)"> =C2=A0</span><span style=3D"color:rgb(0,0,0);background-co= lor:rgb(255,255,255)">system_u:object_r:sshd_exec_t:s0</span><br></span></d= iv><div><br></div><div>Equivalency is a feature to substitute one path in t= he policy with another.</div><div>Secondly, there is a script to take care = of all entries referring to /usr/sbin, e. g. from a local policy module. Fe= el free to file a bug report if an improvement is needed.</div><div><br></d= iv><div><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px= 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <br> -- <br> _______________________________________________<br> selinux mailing list -- <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br> To unsubscribe send an email to <a href=3D"mailto:[email protected]= aproject.org" target=3D"_blank">[email protected]</a><b= r> Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro= ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe= doraproject.org/en-US/project/code-of-conduct/</a><br> List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui= delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik= i/Mailing_list_guidelines</a><br> List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel= [email protected]" rel=3D"noreferrer" target=3D"_blank">https://= lists.fedoraproject.org/archives/list/[email protected]</a><b= r> Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras= tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/= fedora-infrastructure/new_issue</a><br> </blockquote></div><div><br clear=3D"all"></div><br><span class=3D"gmail_si= gnature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><d= iv dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D= "ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><br= > Zdenek Pytela</div><div dir=3D"ltr">Security SELinux team</div></div></div>= </div></div></div></div></div></div></div></div></div></div></div></div> -- <br> _______________________________________________<br> selinux mailing list -- <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br> To unsubscribe send an email to <a href=3D"mailto:[email protected]= aproject.org" target=3D"_blank">[email protected]</a><b= r> Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro= ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe= doraproject.org/en-US/project/code-of-conduct/</a><br> List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui= delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik= i/Mailing_list_guidelines</a><br> List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel= [email protected]" rel=3D"noreferrer" target=3D"_blank">https://= lists.fedoraproject.org/archives/list/[email protected]</a><b= r> Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras= tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/= fedora-infrastructure/new_issue</a><br> </blockquote></div> --000000000000ef6c94062b4a238f-- --===============8346210119936682068== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0 Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y dCBpdDogaHR0cHM6Ly9wYWd1cmUuaW8vZmVkb3JhLWluZnJhc3RydWN0dXJlL25ld19pc3N1ZQo= --===============8346210119936682068==--