-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
rhel-9.3.0
-
None
-
None
-
None
-
3
-
rhel-sst-security-selinux
-
ssg_security
-
5
-
QE ack
-
False
-
-
None
-
CY24Q2, SELINUX 241016 - 241106, SELINUX 241106 - 241127
-
-
None
-
None
-
-
All
-
None
What were you trying to do that didn't work?
When RHEL user wants to list of SELinux contexts on the system, it's required to be root. However, there is nothing secret to get these data.
Please provide the package NVR for which bug is seen:
policycoreutils-3.5-1.el9
How reproducible:
Always
Expected results
$ id -u
1000
$ semanage fcontext -l
SELinux fcontext type Context
/ directory system_u:object_r:root_t:s0
/.* all files system_u:object_r:default_t:s0
/[^/]+ regular file system_u:object_r:etc_runtime_t:s0
/\.autofsck regular file system_u:object_r:etc_runtime_t:s0
/\.autorelabel regular file system_u:object_r:etc_runtime_t:s0
/\.ismount-test-file regular file system_u:object_r:sosreport_tmp_t:s0
/\.journal all files <<None>>
/\.snapshots(/.*)? all files system_u:object_r:snapperd_data_t:s0
/\.suspended regular file system_u:object_r:etc_runtime_t:s0
/a?quota\.(user|group) regular file system_u:object_r:quota_db_t:s0
...
...
...
Actual results
$ id -u
1000
$ semanage fcontext -l
ValueError: SELinux policy is not managed or store cannot be accessed.
I believe it's worth to investigate it to find a solution to be able list context without root permission. It could help for tools such as udica to get SELinux context without need to run these tools as root.