Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-5172

restorecon: Could not set context: No such file or directory

    • None
    • Moderate
    • rhel-sst-security-selinux
    • ssg_security
    • 8
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • If docs needed, set a value
    • None

      Description of problem:

      While running a recursive restorecon, I found that it can fail with

      $ restorecon -nvvR /
      restorecon: Could not set context for /boot/grub2/grubenvl355DR: No such file or directory

      This is likely because of a well-known "readdir vs read" race condition, where a program does readdir() first, and then goes over the resulting list of files, performing some operation on them.
      If one of the files gets deleted while that traversal is happening (such as by being a temporary file), the program would get ENOENT.

      Version-Release number of selected component (if applicable):
      policycoreutils-3.3-6.el9_0.x86_64

      How reproducible:
      rarely on a real system
      always using the reproducer below, within ~10 seconds

      Steps to Reproduce:
      0. Have (preferably) multicore (SMP) hardware
      1. Open up two terminals
      2. In one, run a loop of always-creating files with a wrong context, ie.

      • mkdir foo; cd foo
      • while :; do touch a b c; chcon -t etc_t a b c; rm -f a b c; done
        3. In the other terminal, run restorecon attempting to correct them, ie.
      • while restorecon -Rvvn foo/; do :; done

      Actual results:
      restorecon sometimes fails on a filesystem using temporary files

      Expected results:
      restorecon silently ignores ENOENT for files that were seen in readdir()

              rhn-engineering-plautrba Petr Lautrbach
              jjaburek@redhat.com Jiri Jaburek
              Petr Lautrbach Petr Lautrbach
              SSG Security QE SSG Security QE
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: