Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-15434

`sepolicy generate --application` does not detect writable locations [rhel-9]

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • rhel-9.4
    • rhel-9.2.0
    • policycoreutils
    • None
    • policycoreutils-3.6-1.el9
    • None
    • None
    • 1
    • rhel-sst-security-selinux
    • ssg_security
    • 19
    • 1
    • QE ack
    • False
    • Hide

      None

      Show
      None
    • No
    • CY23Q4
    • Hide

      The `sepolicy generate --application` command generates an appropriate .fc file which contains file context patterns for writable locations like /var/lib, /var/log, /run etc.

      Show
      The `sepolicy generate --application` command generates an appropriate .fc file which contains file context patterns for writable locations like /var/lib, /var/log, /run etc.
    • Pass
    • Enabled
    • Automated
    • Release Note Not Required
    • None

      run https://src.fedoraproject.org/tests/selinux/blob/main/f/policycoreutils/sepolicy-generate-application

      :: [ 06:18:58 ] :: [  BEGIN   ] :: Running 'mkdir policy'
      :: [ 06:18:58 ] :: [   PASS   ] :: Command 'mkdir policy' (Expected 0, got 0)
      :: [ 06:18:58 ] :: [  BEGIN   ] :: Running 'sepolicy generate -p policy --application /usr/bin/mysqld_safe'
      nm: /usr/bin/mariadbd-safe: file format not recognized
      Created the following files:
      policy/mariadbd_safe.te # Type Enforcement file
      policy/mariadbd_safe.if # Interface file
      policy/mariadbd_safe.fc # File Contexts file
      policy/mariadbd_safe_selinux.spec # Spec file
      policy/mariadbd_safe.sh # Setup Script
      
      :: [ 06:18:59 ] :: [   PASS   ] :: Command 'sepolicy generate -p policy --application /usr/bin/mysqld_safe' (Expected 0, got 0)
      :: [ 06:18:59 ] :: [  BEGIN   ] :: Running 'cat policy/*fc'
      /usr/bin/mariadbd-safe		--	gen_context(system_u:object_r:mariadbd_safe_exec_t,s0)
      :: [ 06:18:59 ] :: [   PASS   ] :: Command 'cat policy/*fc' (Expected 0, got 0)
      :: [ 06:18:59 ] :: [  BEGIN   ] :: Running 'grep /var/lib/mysql policy/*.fc'
      :: [ 06:18:59 ] :: [   FAIL   ] :: Command 'grep /var/lib/mysql policy/*.fc' (Expected 0, got 1)
      :: [ 06:18:59 ] :: [  BEGIN   ] :: Running 'grep /var/log/mariadb policy/*.fc'
      :: [ 06:18:59 ] :: [   FAIL   ] :: Command 'grep /var/log/mariadb policy/*.fc' (Expected 0, got 1)
      :: [ 06:18:59 ] :: [  BEGIN   ] :: Running 'rm -rf policy'
      :: [ 06:18:59 ] :: [   PASS   ] :: Command 'rm -rf policy' (Expected 0, got 0)
      
      

      fixed in Fedora - https://github.com/fedora-selinux/selinux/commit/d925b00da35384331df9bf31935398c37117f895

      What were you trying to do that didn't work?

      Please provide the package NVR for which bug is seen:

      How reproducible:

      Steps to reproduce

      Expected results

      Actual results

              rhn-engineering-plautrba Petr Lautrbach
              rhn-engineering-plautrba Petr Lautrbach
              Petr Lautrbach Petr Lautrbach
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: