| 1 |
On Sat, Aug 16, 2014 at 03:46:43PM -0400, Ben Pritchard wrote: |
| 2 |
> Hello all |
| 3 |
> |
| 4 |
> In March, I reported some issues with SELinux contexts in /run. (I seem |
| 5 |
> to have misplaced the email -- archive at |
| 6 |
> http://article.gmane.org/gmane.linux.gentoo.hardened/6180). |
| 7 |
> |
| 8 |
> It look like Sven added the functionality a few months ago, and it is |
| 9 |
> available in version 2.20140311-r5 (currently ~arch). |
| 10 |
|
| 11 |
I actually fixed this, its a problem with OpenRC not with SELinux per-se |
| 12 |
|
| 13 |
https://bugs.gentoo.org/show_bug.cgi?id=516956 |
| 14 |
|
| 15 |
Checkpath now does a restorecon when it creates things, it will be in |
| 16 |
openRC-0.13 which is not yet released. Can you test openrc-9999 (it has |
| 17 |
all the fixes in it and is quite close to release). |
| 18 |
> |
| 19 |
> Note 1: There are a few pacakges that need this implemented. Fail2ban |
| 20 |
> is one on my machine. Should I file a bug report (probably against |
| 21 |
> sec-policy/selinux-fail2ban)? |
| 22 |
> |
| 23 |
> Note 2: There's possibly a bug in the new tmpfiles module |
| 24 |
> (policy/modules/system/tmpfiles.fc). I'm not so sure /lib/rc/bin/checkpath |
| 25 |
> should have context tmpfiles_exec_t. Again, this seems to make several |
| 26 |
> directories (and maybe files) in /run have context var_run_t. |
| 27 |
|
| 28 |
The tmpfiles module goes along with the new OpenRC the current stable |
| 29 |
(0.12) is missing the relabel parts. |
| 30 |
|
| 31 |
> What I think is happening is that init_daemon_pid_file() only allows |
| 32 |
> transitions for the initrc_t domain, and checkpath is no longer running in |
| 33 |
> that domain. Therefore, the file transition from var_run_t to whatever |
| 34 |
> type is specified as the first argument in init_daemon_pid_file is |
| 35 |
> not done. |
| 36 |
> |
| 37 |
> Changing the context of /lib/rc/bin/checkpath to bin_t makes many more |
| 38 |
> of the files in /run have the correct context again on boot. |
| 39 |
|
| 40 |
Can you try OpenRC-0.13 and have checkpath and tmpfiles.sh with the |
| 41 |
tmpfiles labels and see if that fixes it. |
| 42 |
|
| 43 |
If that does not fix it, we will need to add in fcontexts for things, |
| 44 |
filing bugs would be great :) |
| 45 |
|
| 46 |
> (perhaps this belongs on the selinux mailing list?) |
| 47 |
|
| 48 |
No, this is gentoo related (for now at least, we're working on |
| 49 |
upstreaming it) |
| 50 |
|
| 51 |
-- Jason |
Archives