-
Bug
-
Resolution: Done-Errata
-
Minor
-
rhel-8.8.0
-
selinux-policy-3.14.3-130.el8
-
None
-
Low
-
rhel-security-selinux
-
ssg_security
-
8
-
None
-
QE ack, Dev ack
-
False
-
False
-
-
No
-
None
-
If docs needed, set a value
-
-
All
-
None
Description of problem:
There is the following context in the database:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
/home/[^/]+/tmp directory unconfined_u:object_r:user_tmp_t:s0
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
This makes all files created under the user's "tmp/" directory be labeled appropriately with "user_tmp_t".
But executing restorecon wants to relabel the files back to "user_home_t", which is probably not appropriate:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
- restorecon -Frvn /home/admin/tmp
Would relabel /home/admin/tmp/foo from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:user_home_t:s0-
-
-
-
-
-
- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
-
-
-
-
-
-
Same issue happens for other similar locations:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
/home/[^/]+/\.tmp directory unconfined_u:object_r:user_tmp_t:s0
/home/[^/]+/tmp directory unconfined_u:object_r:user_tmp_t:s0
/home/staff/\.tmp directory staff_u:object_r:user_tmp_t:s0
/home/staff/tmp directory staff_u:object_r:user_tmp_t:s0
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
Version-Release number of selected component (if applicable):
selinux-policy-3.14.3-117.el8_8.2.noarch
How reproducible:
Always
Steps to Reproduce:
1. Create a user and create temporary files
- useradd admin
- sudo -u admin -i
$ mkdir tmp
$ touch tmp/foo
2. Check labels
- ls -Zd1 /home/admin/tmp /home/admin/tmp/foo
unconfined_u:object_r:user_tmp_t:s0 /home/admin/tmp
unconfined_u:object_r:user_tmp_t:s0 /home/admin/tmp/foo
3. Execute restorecon
- restorecon -Frnv /home/admin/tmp
Actual results:
Would relabel /home/admin/tmp/foo from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:user_home_t:s0
Expected results:
No relabeling
- external trackers
- links to
-
RHBA-2023:121335 selinux-policy bug fix and enhancement update
- mentioned on