Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1360969 - fixfiles -C verify is changing file contexts
Summary: fixfiles -C verify is changing file contexts
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: policycoreutils
Version: 7.3
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Petr Lautrbach
QA Contact: Dalibor Pospíšil
Depends On:
Blocks: 1391857
TreeView+ depends on / blocked
Reported: 2016-07-28 05:11 UTC by Dan Callaghan
Modified: 2016-11-04 09:21 UTC (History)
7 users (show)

Fixed In Version: policycoreutils-2.5-7.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1391857 (view as bug list)
Last Closed: 2016-11-04 02:14:56 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2016:2279 normal SHIPPED_LIVE policycoreutils bug fix and enhancement update 2016-11-03 13:35:48 UTC

Description Dan Callaghan 2016-07-28 05:11:06 UTC
Description of problem:
When using the -C option for fixfiles, the verify and check commands (which are supposed to not change any filesystem labels) actually *do* modify labels.

Version-Release number of selected component (if applicable):

How reproducible:
somewhat easily

Steps to Reproduce:
1. Make a fake version of /etc/selinux/targeted/contexts/files/file_contexts with rules for /etc removed, so that when you pass it to fixfiles -C it will try to relabel /etc:
cp /etc/selinux/targeted/contexts/files/file_contexts file_contexts_dummy
sed -i -e '/^\/etc/d' file_contexts_dummy
2. Make a mislabelled file in /etc:
touch /etc/relabelthis
chcon -t admin_home_t /etc/relabelthis
3. Run: fixfiles -C file_contexts_dummy check
or: fixfiles -C file_contexts_dummy verify

Actual results:
/sbin/restorecon reset /etc/relabelthis context unconfined_u:object_r:admin_home_t:s0->unconfined_u:object_r:etc_t:s0

and then file context is actually changed:
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   /etc/relabelthis

Expected results:
Should print but not change file context.

Additional info:
Seems to be because -n is not being passed down to restorecon properly in the code path for -C. This patch fixes it:

--- /usr/sbin/fixfiles	2016-07-14 03:58:07.000000000 -0400
+++ fixfiles.patched	2016-07-28 01:08:23.776210742 -0400
@@ -194,7 +194,7 @@
 		  esac; \
 	       fi; \
 	    done | \
-	${RESTORECON} ${VERBOSE} -i -f - -R `exclude_dirs`; \
+	${RESTORECON} $* ${VERBOSE} -i -f - -R `exclude_dirs`; \

Comment 2 Petr Lautrbach 2016-08-09 12:33:49 UTC
Thanks for the investigation and for the patch. It'll be applied in the next update and I'll resend it upstream for inclusion.

Comment 6 errata-xmlrpc 2016-11-04 02:14:56 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

Note You need to log in before you can comment on or make changes to this bug.