-
Bug
-
Resolution: Unresolved
-
Normal
-
None
-
rhel-9.6, rhel-10.0
-
No
-
Low
-
1
-
rhel-security-selinux
-
ssg_security
-
5
-
False
-
False
-
-
None
-
Red Hat Enterprise Linux
-
SELINUX 251119: 15
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
None
This is somehow similar to RHEL-94661.
When installing or updating annobin package, the file /usr/lib/rpm/redhat/redhat-annobin-cc1 shipped by dependent package redhat-rpm-config becomes untrusted:
# fapolicyd-cli --check-trustdb [...] /usr/lib/rpm/redhat/redhat-annobin-cc1 miscompares: size sha256 [...]
This occurs because the file is initially shipped by redhat-rpm-config package as a plain file, but there is a triggerin scriptlet in redhat-rpm-config executing /usr/lib/rpm/redhat/redhat-annobin-plugin-select.sh which changes the plain file as a symlink:
# ls -l /usr/lib/rpm/redhat/redhat-annobin-cc1 lrwxrwxrwx. 1 root root 38 Jun 2 13:16 /usr/lib/rpm/redhat/redhat-annobin-cc1 -> redhat-annobin-select-gcc-built-plugin
