Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-1678

Regression due to /usr/bin/msmtp security context mismatch

    • selinux-policy-3.14.3-130.el8
    • Yes
    • Medium
    • sst_security_selinux
    • ssg_security
    • 8
    • None
    • QE ack, Dev ack
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Hide

      SELinux policy should define sendmail_exec_t as a default SELinux label for the /usr/bin/msmtp program. The /CoreOS/selinux-policy/Regression/arpwatch-and-similar test should pass as an indication that the issue is fixed.

      Show
      SELinux policy should define sendmail_exec_t as a default SELinux label for the /usr/bin/msmtp program. The /CoreOS/selinux-policy/Regression/arpwatch-and-similar test should pass as an indication that the issue is fixed.
    • Pass
    • Automated
    • None

      Description of problem:
      The arpwatch testsuite for selinux-policy shows test failure due to wrong security context in RHEL-8.9. The context type should be "sendmail_exec_t" instead of "bin_t". Below are the results of matchpathcon command from 8.9 and 9.3:

      RHEL-8.9:
      -----------------

      1. matchpathcon /usr/bin/msmtp
        /usr/bin/msmtp system_u:object_r:bin_t:s0

      RHEL-9.3:
      -----------------

      1. matchpathcon /usr/bin/msmtp
        /usr/bin/msmtp system_u:object_r:sendmail_exec_t:s0

      I am unsure whether this difference is by design or an error.

      Version-Release number of selected component (if applicable):
      selinux-policy-3.14.3-127.el8.noarch
      selinux-policy-devel-3.14.3-127.el8.noarch
      selinux-policy-targeted-3.14.3-127.el8.noarch

      How reproducible:
      Always

      Steps to Reproduce:
      1. Run matchpathcon on /usr/bin/msmtp and compare results between rhel-9.3 and rhel-8.9

      Actual results:
      ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
      :: bz#2176583
      ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

      /usr/sbin/arpwatch system_u:object_r:arpwatch_exec_t:s0
      :: [ 03:29:46 ] :: [ PASS ] :: Result of matchpathcon /usr/sbin/arpwatch should contain arpwatch_exec_t (Assert: expected 0, got 0)
      /usr/bin/msmtp system_u:object_r:bin_t:s0
      :: [ 03:29:48 ] :: [ FAIL ] :: Result of matchpathcon /usr/bin/msmtp should contain sendmail_exec_t (Assert: expected 0, got 1)
      :: [ 03:29:48 ] :: [ INFO ] :: rlSESearchRule: checking rule 'allow arpwatch_t sendmail_exec_t : file

      { map execute }

      [ ]'
      FILTERED RULES
      allow arpwatch_t mta_exec_type:file

      { execute execute_no_trans getattr ioctl map open read }

      ;
      :: [ 03:29:51 ] :: [ PASS ] :: check permission 'map' is present (Assert: '0' should equal '0')
      :: [ 03:29:51 ] :: [ PASS ] :: check permission 'execute' is present (Assert: '0' should equal '0')
      ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
      :: Duration: 7s
      :: Assertions: 3 good, 1 bad
      :: RESULT: FAIL (bz#2176583)

      Expected results:
      A GREEN test run without any failures.

      Additional info:

            rhn-support-zpytela Zdenek Pytela
            apeetham@redhat.com Amith Kumar Peethambaran
            Zdenek Pytela Zdenek Pytela
            Amith Kumar Peethambaran Amith Kumar Peethambaran
            Votes:
            0 Vote for this issue
            Watchers:
            9 Start watching this issue

              Created:
              Updated:
              Resolved: