Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-1099

User's temporary files are not labeled correctly

    • selinux-policy-3.14.3-130.el8
    • None
    • Low
    • sst_security_selinux
    • ssg_security
    • 8
    • None
    • QE ack, Dev ack
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Hide

      SELinux policy should not define any default SELinux context for objects stored in the /home/<user>/tmp directory.

      Show
      SELinux policy should not define any default SELinux context for objects stored in the /home/<user>/tmp directory.
    • Pass
    • None
    • If docs needed, set a value
    • None

      Description of problem:

      There is the following context in the database:
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
      /home/[^/]+/tmp directory unconfined_u:object_r:user_tmp_t:s0
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      This makes all files created under the user's "tmp/" directory be labeled appropriately with "user_tmp_t".
      But executing restorecon wants to relabel the files back to "user_home_t", which is probably not appropriate:
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      1. restorecon -Frvn /home/admin/tmp
        Would relabel /home/admin/tmp/foo from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:user_home_t:s0
                    • 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      Same issue happens for other similar locations:
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
      /home/[^/]+/\.tmp directory unconfined_u:object_r:user_tmp_t:s0
      /home/[^/]+/tmp directory unconfined_u:object_r:user_tmp_t:s0
      /home/staff/\.tmp directory staff_u:object_r:user_tmp_t:s0
      /home/staff/tmp directory staff_u:object_r:user_tmp_t:s0
      -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

      Version-Release number of selected component (if applicable):

      selinux-policy-3.14.3-117.el8_8.2.noarch

      How reproducible:

      Always

      Steps to Reproduce:
      1. Create a user and create temporary files

      1. useradd admin
      2. sudo -u admin -i
        $ mkdir tmp
        $ touch tmp/foo

      2. Check labels

      1. ls -Zd1 /home/admin/tmp /home/admin/tmp/foo
        unconfined_u:object_r:user_tmp_t:s0 /home/admin/tmp
        unconfined_u:object_r:user_tmp_t:s0 /home/admin/tmp/foo

      3. Execute restorecon

      1. restorecon -Frnv /home/admin/tmp

      Actual results:

      Would relabel /home/admin/tmp/foo from unconfined_u:object_r:user_tmp_t:s0 to unconfined_u:object_r:user_home_t:s0

      Expected results:

      No relabeling

            rhn-support-zpytela Zdenek Pytela
            rhn-support-rmetrich Renaud Métrich
            Zdenek Pytela Zdenek Pytela
            Milos Malik Milos Malik
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: