Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-113167

Wrong SELinux context set on the /usr/sbin/smartd file

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • selinux-policy-42.1.12-1.el10
    • No
    • Moderate
    • 2
    • rhel-security-selinux
    • 14
    • 1
    • QE ack
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • SELINUX 251223: 16, BaseUtilsC Sprint CY25_04
    • Hide

      The smartd program is labeled correctly after installation of the smartmontools package.

      Show
      The smartd program is labeled correctly after installation of the smartmontools package.
    • Pass
    • Automated
    • Release Note Not Required
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      Our test checking selinux contexts on the installed filesystem failed:

      Would relabel /usr/sbin/smartd from system_u:object_r:bin_t:s0 to system_u:object_r:fsdaemon_exec_t:s0 

      The context listed via semodule in the installation environment is the expected one:

      [anaconda root@kvm-04-guest11 ~]# semanage fcontext -l | grep /usr/sbin/smartd
      /usr/sbin/smartd                                   regular file       system_u:object_r:fsdaemon_exec_t:s0 
      [anaconda root@kvm-04-guest11 ~]# ls -Z /mnt/sysroot/sbin/smartd
      system_u:object_r:bin_t:s0 /mnt/sysroot/sbin/smartd

      Also, after removing and installing the smartmontools package again in the installed system, the context is set properly. Based on this observation, I believe the issue may be caused by Anaconda, even though the particular mechanism is not clear to me.

      What is the impact of this issue to you?

      It may potentially cause issues to smartd due to possible AVC denials.

      Please provide the package NVR for which the bug is seen:

      anaconda-40.22.3.32-1.el10 (smartmontools-selinux-7.4-8.el10, selinux-policy-42.1.7-1.el10) on RHEL-10.1-20250826.2

      How reproducible is this bug?:

      Always.

      Steps to reproduce

      1. Install with the default package set (%packages --default in kickstart).
      2. Run restorecon -vn /usr/sbin/smartd to check if the selinux file context is set properly.

      Expected results

      The file context is set properly, no warnings from restorecon are printed.

      Actual results

      restorecon shows an improper selinux context.

              rhn-support-zpytela Zdenek Pytela
              rhn-support-jikortus Jiri Kortus
              Zdenek Pytela Zdenek Pytela
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              12 Start watching this issue

                Created:
                Updated: