-
Bug
-
Resolution: Done-Errata
-
Minor
-
rhel-8.9.0
-
selinux-policy-3.14.3-130.el8
-
Yes
-
Medium
-
sst_security_selinux
-
ssg_security
-
8
-
None
-
QE ack, Dev ack
-
False
-
-
No
-
None
-
-
Pass
-
Automated
-
-
Unspecified
-
None
Description of problem:
The arpwatch testsuite for selinux-policy shows test failure due to wrong security context in RHEL-8.9. The context type should be "sendmail_exec_t" instead of "bin_t". Below are the results of matchpathcon command from 8.9 and 9.3:
RHEL-8.9:
-----------------
- matchpathcon /usr/bin/msmtp
/usr/bin/msmtp system_u:object_r:bin_t:s0
RHEL-9.3:
-----------------
- matchpathcon /usr/bin/msmtp
/usr/bin/msmtp system_u:object_r:sendmail_exec_t:s0
I am unsure whether this difference is by design or an error.
Version-Release number of selected component (if applicable):
selinux-policy-3.14.3-127.el8.noarch
selinux-policy-devel-3.14.3-127.el8.noarch
selinux-policy-targeted-3.14.3-127.el8.noarch
How reproducible:
Always
Steps to Reproduce:
1. Run matchpathcon on /usr/bin/msmtp and compare results between rhel-9.3 and rhel-8.9
Actual results:
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: bz#2176583
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
/usr/sbin/arpwatch system_u:object_r:arpwatch_exec_t:s0
:: [ 03:29:46 ] :: [ PASS ] :: Result of matchpathcon /usr/sbin/arpwatch should contain arpwatch_exec_t (Assert: expected 0, got 0)
/usr/bin/msmtp system_u:object_r:bin_t:s0
:: [ 03:29:48 ] :: [ FAIL ] :: Result of matchpathcon /usr/bin/msmtp should contain sendmail_exec_t (Assert: expected 0, got 1)
:: [ 03:29:48 ] :: [ INFO ] :: rlSESearchRule: checking rule 'allow arpwatch_t sendmail_exec_t : file
[ ]'
FILTERED RULES
allow arpwatch_t mta_exec_type:file
;
:: [ 03:29:51 ] :: [ PASS ] :: check permission 'map' is present (Assert: '0' should equal '0')
:: [ 03:29:51 ] :: [ PASS ] :: check permission 'execute' is present (Assert: '0' should equal '0')
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: Duration: 7s
:: Assertions: 3 good, 1 bad
:: RESULT: FAIL (bz#2176583)
Expected results:
A GREEN test run without any failures.
Additional info:
- external trackers
- links to
-
RHBA-2023:121335 selinux-policy bug fix and enhancement update
- mentioned on