Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-4735

List of SELinux contexts requires root premissions

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • rhel-9.3.0
    • policycoreutils
    • None
    • None
    • None
    • 3
    • rhel-sst-security-selinux
    • ssg_security
    • 5
    • QE ack
    • False
    • Hide

      None

      Show
      None
    • None
    • CY24Q2, SELINUX 241016 - 241106, SELINUX 241106 - 241127
    • Hide

      A non-root user can list the file context patterns defined in the current SELinux policy via `semanage fcontext -l`.

      Show
      A non-root user can list the file context patterns defined in the current SELinux policy via `semanage fcontext -l`.
    • None
    • None
    • All
    • None

      What were you trying to do that didn't work?

      When RHEL user wants to list of SELinux contexts on the system, it's required to be root. However, there is nothing secret to get these data. 

      Please provide the package NVR for which bug is seen:

      policycoreutils-3.5-1.el9

      How reproducible:

      Always

      Expected results

      $ id -u

      1000

      $ semanage fcontext -l

      SELinux fcontext                                   type               Context

      /                                                  directory          system_u:object_r:root_t:s0 
      /.*                                                all files          system_u:object_r:default_t:s0 
      /[^/]+                                             regular file       system_u:object_r:etc_runtime_t:s0 
      /\.autofsck                                        regular file       system_u:object_r:etc_runtime_t:s0 
      /\.autorelabel                                     regular file       system_u:object_r:etc_runtime_t:s0 
      /\.ismount-test-file                               regular file       system_u:object_r:sosreport_tmp_t:s0 
      /\.journal                                         all files          <<None>>
      /\.snapshots(/.*)?                                 all files          system_u:object_r:snapperd_data_t:s0 
      /\.suspended                                       regular file       system_u:object_r:etc_runtime_t:s0 
      /a?quota\.(user|group)                             regular file       system_u:object_r:quota_db_t:s0 

      ...

      ...

      ...

      Actual results

      $ id -u

      1000

      $ semanage fcontext -l

      ValueError: SELinux policy is not managed or store cannot be accessed.

       

      I believe it's worth to investigate it to find a solution to be able list context without root permission. It could help for tools such as udica to get SELinux context without need to run these tools as root.

              rhn-engineering-plautrba Petr Lautrbach
              rhn-engineering-lvrabec Lukas Vrabec
              Petr Lautrbach Petr Lautrbach
              Milos Malik Milos Malik
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: