Re: restorecon ignoring my policy
Zdenek Pytela via selinux <[email protected]> Thu, 9 Jan 2025 20:56:53 +0100
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Message-ID | <CAO4UijCJZvB2NS6MuDFkK9F7E9c2GD+7f9q9+Nc7i2WY2+JA7Q@mail.gmail.com> |
--===============7205722834220700506== Content-Type: multipart/alternative; boundary="000000000000dccb1e062b4b6191" --000000000000dccb1e062b4b6191 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Jan 9, 2025 at 7:28=E2=80=AFPM David Sastre Medina < [email protected]> wrote: > Hello Zdenek, > > There are a few executables that are not being properly labelled, and > restorecon does not correct it. > I don't have any custom policy installed in this system. > This is one example: > > $ sudo semanage fcontext -l | rg /usr/sbin/smartd > /usr/sbin/smartd regular file > system_u:object_r:fsdaemon_exec_t:s0 > $ ls -lZ /usr/sbin/smartd > -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 671608 Jul 20 02:00 > /usr/sbin/smartd > > $ sudo restorecon -v /usr/sbin/smartd > $ ls -lZ /usr/sbin/smartd > -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 671608 Jul 20 02:00 > /usr/sbin/smartd > > The other executables potentially affected by the same problem (I cannot > check, I don't have any of them installed), are: > > $ sudo semanage fcontext -l | rg /usr/sbin/ > /usr/sbin/nbdkit regular file > system_u:object_r:nbdkit_exec_t:s0 > /usr/sbin/pcm-sensor-server regular file > system_u:object_r:pcmsensor_exec_t:s0 > /usr/sbin/rhel-push-plugin regular file > system_u:object_r:container_runtime_exec_t:s0 > /usr/sbin/smartd regular file > system_u:object_r:fsdaemon_exec_t:s0 > /usr/sbin/tlshd regular file > system_u:object_r:ktlshd_exec_t:s0 > > Let me know if you need a bug opened for this, and where (GitHub, BZ, ...= ) > David, thanks for the report, no need for an action now. Some of them were fixed just a while ago, the others need some attention to find out what makes them different from other entries which work fine. nbdkit and smartmontools ship their own policy and it needs to be changed there. It should also be fixed on selinux-policy update or when the script is run manually; that's certainly meant as a temporary measure only. > > Regards. > > > On Thu, Jan 9, 2025 at 6:57=E2=80=AFPM Zdenek Pytela via selinux < > [email protected]> wrote: > >> >> >> On Fri, Jan 3, 2025 at 6:01=E2=80=AFPM Sam Varshavchik via selinux < >> [email protected]> wrote: >> >>> Zdenek Pytela writes: >>> >>> > Anyway, the long term solution is to change the entries to use >>> /usr/bin. >>> >>> So, right now: >>> >>> 1. A package installs stuff in /usr/sbin >>> 2. It installs an selinux policy file referencing filenames in /usr/bin >>> >>> Am I the only one who has =E2=80=A6questions, here? >>> >> Firstly, there is an equivalency supporting the change: >> >> f42# semanage fcontext -l | grep /usr/sbin.=3D >> /usr/sbin =3D /usr/bin >> f42# ls -Z /usr/sbin/sshd >> system_u:object_r:sshd_exec_t:s0 /usr/sbin/sshd >> f42# matchpathcon /usr/sbin/sshd >> /usr/sbin/sshd system_u:object_r:sshd_exec_t:s0 >> >> Equivalency is a feature to substitute one path in the policy with >> another. >> Secondly, there is a script to take care of all entries referring to >> /usr/sbin, e. g. from a local policy module. Feel free to file a bug rep= ort >> if an improvement is needed. >> >> >> >>> -- >>> _______________________________________________ >>> selinux mailing list -- [email protected] >>> To unsubscribe send an email to [email protected] >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedoraproject.org/archives/list/[email protected]= ct.org >>> Do not reply to spam, report it: >>> https://pagure.io/fedora-infrastructure/new_issue >>> >> >> >> -- >> >> Zdenek Pytela >> Security SELinux team >> -- >> _______________________________________________ >> selinux mailing list -- [email protected] >> To unsubscribe send an email to [email protected] >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedoraproject.org/archives/list/[email protected]= t.org >> Do not reply to spam, report it: >> https://pagure.io/fedora-infrastructure/new_issue >> > --=20 Zdenek Pytela Security SELinux team --000000000000dccb1e062b4b6191 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote g= mail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Jan 9, = 2025 at 7:28=E2=80=AFPM David Sastre Medina <<a href=3D"mailto:d.sastre.= [email protected]">[email protected]</a>> wrote:<br></div><blockq= uote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1p= x solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div>Hello Zden= ek,</div><div><br></div><div>There are a few executables that are not being= properly labelled, and restorecon does not correct it.</div><div>I don'= ;t have any custom policy installed in this system.<br></div><div>This is o= ne example:</div><div><br></div><div>$ sudo semanage fcontext -l | rg /usr/= sbin/smartd<br>/usr/sbin/smartd =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 regular file =C2=A0 =C2=A0 =C2=A0 system_u:object_r:fsdaemon_exec_t:s0 = <br>$ ls -lZ /usr/sbin/smartd<br>-rwxr-xr-x. 1 root root system_u:object_r:= bin_t:s0 671608 Jul 20 02:00 /usr/sbin/smartd<br></div><div></div><div><br>= </div><div>$ sudo restorecon -v /usr/sbin/smartd<br>$ ls -lZ /usr/sbin/smar= td<br>-rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 671608 Jul 20 02:0= 0 /usr/sbin/smartd</div><div><br></div><div>The other executables potential= ly affected by the same problem (I cannot check, I don't have any of th= em installed), are:</div><div><br></div><div>$ sudo semanage fcontext -l | = rg /usr/sbin/</div><div>/usr/sbin/nbdkit =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 regular file =C2=A0 =C2=A0 =C2=A0 system_u:object_r:nbdkit_exec_= t:s0 <br>/usr/sbin/pcm-sensor-server =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0regular file =C2=A0 =C2=A0 =C2= =A0 system_u:object_r:pcmsensor_exec_t:s0 <br>/usr/sbin/rhel-push-plugin = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 regular file =C2=A0 =C2=A0 =C2=A0 system_u:object_r:container_ru= ntime_exec_t:s0 <br>/usr/sbin/smartd =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 regular file =C2=A0 =C2=A0 =C2=A0 system_u:object_r:fsdaemon_exec_t:= s0 <br>/usr/sbin/tlshd =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0re= gular file =C2=A0 =C2=A0 =C2=A0 system_u:object_r:ktlshd_exec_t:s0</div><di= v><br></div><div></div><div>Let me know if you need a bug opened for this, = and where (GitHub, BZ, ...)<br></div></div></blockquote><div>David,</div><d= iv>thanks for the report, no need for an action now. Some of them were fixe= d just a while ago, the others need some attention to find out what makes t= hem different from other entries which work fine. nbdkit and smartmontools = ship their own policy and it needs to be changed there.</div><div>It should= also be fixed on selinux-policy update or when the script is run manually;= that's certainly meant as a temporary measure only.<br></div><div><br>= </div><div>=C2=A0<br></div><blockquote class=3D"gmail_quote" style=3D"margi= n:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex= "><div dir=3D"ltr"><div></div><div><br></div><div>Regards.<br></div><div><b= r></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmai= l_attr">On Thu, Jan 9, 2025 at 6:57=E2=80=AFPM Zdenek Pytela via selinux &l= t;<a href=3D"mailto:[email protected]" target=3D"_blank">seli= [email protected]</a>> wrote:<br></div><blockquote class=3D"gm= ail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,= 204,204);padding-left:1ex"><div dir=3D"ltr"><div dir=3D"ltr"><br></div><br>= <div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Ja= n 3, 2025 at 6:01=E2=80=AFPM Sam Varshavchik via selinux <<a href=3D"mai= lto:[email protected]" target=3D"_blank">[email protected]= project.org</a>> wrote:<br></div><blockquote class=3D"gmail_quote" style= =3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding= -left:1ex">Zdenek Pytela writes:<br> <br> > Anyway, the long term solution is to change the entries to use /usr/bi= n.<br> <br> So, right now:<br> <br> 1. A package installs stuff in /usr/sbin<br> 2. It installs an selinux policy file referencing filenames in /usr/bin<br> <br> Am I the only one who has =E2=80=A6questions, here?<br></blockquote><div>Fi= rstly, there is an equivalency supporting the change:<br></div><div><span s= tyle=3D"font-family:monospace"><span style=3D"color:rgb(0,0,0);background-c= olor:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">f42# semanage fcontext -l | grep /usr/sbin.=3D</span><span style=3D"colo= r:rgb(0,0,0);background-color:rgb(255,255,255)"> </span><br><span style=3D"font-weight:bold;color:rgb(255,84,84);background-= color:rgb(255,255,255)">/usr/sbin =3D</span><span style=3D"color:rgb(0,0,0)= ;background-color:rgb(255,255,255)"> /usr/bin</span><span style=3D"color:rg= b(0,0,0);background-color:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">f42# ls -Z /usr/sbin/sshd</span><span style=3D"color:rgb(0,0,0);backgrou= nd-color:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">system_u:object_r:sshd_exec_t:s0 </span><span style=3D"font-weight:bold;= color:rgb(84,255,84);background-color:rgb(255,255,255)">/usr/sbin/sshd</spa= n><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">f42# </span><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255= ,255)">matchpathcon /usr/sbin/sshd</span><span style=3D"color:rgb(0,0,0);ba= ckground-color:rgb(255,255,255)"> </span><br><span style=3D"color:rgb(0,0,0);background-color:rgb(255,255,255= )">/usr/sbin/sshd</span><span style=3D"color:rgb(0,0,0);background-color:rg= b(255,255,255)"> =C2=A0</span><span style=3D"color:rgb(0,0,0);background-co= lor:rgb(255,255,255)">system_u:object_r:sshd_exec_t:s0</span><br></span></d= iv><div><br></div><div>Equivalency is a feature to substitute one path in t= he policy with another.</div><div>Secondly, there is a script to take care = of all entries referring to /usr/sbin, e. g. from a local policy module. Fe= el free to file a bug report if an improvement is needed.</div><div><br></d= iv><div><br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px= 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> <br> -- <br> _______________________________________________<br> selinux mailing list -- <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br> To unsubscribe send an email to <a href=3D"mailto:[email protected]= aproject.org" target=3D"_blank">[email protected]</a><b= r> Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro= ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe= doraproject.org/en-US/project/code-of-conduct/</a><br> List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui= delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik= i/Mailing_list_guidelines</a><br> List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel= [email protected]" rel=3D"noreferrer" target=3D"_blank">https://= lists.fedoraproject.org/archives/list/[email protected]</a><b= r> Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras= tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/= fedora-infrastructure/new_issue</a><br> </blockquote></div><div><br clear=3D"all"></div><br><span class=3D"gmail_si= gnature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><d= iv dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D= "ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><br= > Zdenek Pytela</div><div dir=3D"ltr">Security SELinux team</div></div></div>= </div></div></div></div></div></div></div></div></div></div></div></div> -- <br> _______________________________________________<br> selinux mailing list -- <a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a><br> To unsubscribe send an email to <a href=3D"mailto:[email protected]= aproject.org" target=3D"_blank">[email protected]</a><b= r> Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro= ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe= doraproject.org/en-US/project/code-of-conduct/</a><br> List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui= delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik= i/Mailing_list_guidelines</a><br> List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel= [email protected]" rel=3D"noreferrer" target=3D"_blank">https://= lists.fedoraproject.org/archives/list/[email protected]</a><b= r> Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras= tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/= fedora-infrastructure/new_issue</a><br> </blockquote></div> </blockquote></div><div><br clear=3D"all"></div><br><span class=3D"gmail_si= gnature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><d= iv dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D= "ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><br= > Zdenek Pytela</div><div dir=3D"ltr">Security SELinux team</div></div></div>= </div></div></div></div></div></div></div></div></div></div></div></div> --000000000000dccb1e062b4b6191-- --===============7205722834220700506== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlbGlu dXggbWFpbGluZyBsaXN0IC0tIHNlbGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKVG8gdW5z dWJzY3JpYmUgc2VuZCBhbiBlbWFpbCB0byBzZWxpbnV4LWxlYXZlQGxpc3RzLmZlZG9yYXByb2pl Y3Qub3JnCkZlZG9yYSBDb2RlIG9mIENvbmR1Y3Q6IGh0dHBzOi8vZG9jcy5mZWRvcmFwcm9qZWN0 Lm9yZy9lbi1VUy9wcm9qZWN0L2NvZGUtb2YtY29uZHVjdC8KTGlzdCBHdWlkZWxpbmVzOiBodHRw czovL2ZlZG9yYXByb2plY3Qub3JnL3dpa2kvTWFpbGluZ19saXN0X2d1aWRlbGluZXMKTGlzdCBB cmNoaXZlczogaHR0cHM6Ly9saXN0cy5mZWRvcmFwcm9qZWN0Lm9yZy9hcmNoaXZlcy9saXN0L3Nl bGludXhAbGlzdHMuZmVkb3JhcHJvamVjdC5vcmcKRG8gbm90IHJlcGx5IHRvIHNwYW0sIHJlcG9y dCBpdDogaHR0cHM6Ly9wYWd1cmUuaW8vZmVkb3JhLWluZnJhc3RydWN0dXJlL25ld19pc3N1ZQo= --===============7205722834220700506==--