Automatic update for selinux-policy-41.8-1.fc41.
* Wed Jul 10 2024 Zdenek Pytela <zpytela@redhat.com> - 41.8-2
- Drop the publicfile module
* Wed Jul 10 2024 Zdenek Pytela <zpytela@redhat.com> - 41.8-1
- Drop publicfile module
- Remove permissive domain for systemd_nsresourced_t
- Change fs_dontaudit_write_cgroup_files() to apply to cgroup_t
- Label /usr/bin/samba-gpupdate with samba_gpupdate_exec_t
- Allow to create and delete socket files created by rhsm.service
- Allow virtnetworkd exec shell when virt_hooks_unconfined is on
- Allow unconfined_service_t transition to passwd_t
- Support /var is empty
- Allow abrt-dump-journal read all non_security socket files
- Allow timemaster write to sysfs files
- Dontaudit domain write cgroup files
- Label /usr/lib/node_modules/npm/bin with bin_t
- Allow ip the setexec permission
- Allow systemd-networkd write files in /var/lib/systemd/network
- Fix typo in systemd_nsresourced_prog_run_bpf()
* Fri Jun 28 2024 Zdenek Pytela <zpytela@redhat.com> - 41.7-1
- Confine libvirt-dbus
- Allow virtqemud the kill capability in user namespace
- Allow rshim get options of the netlink class for KOBJECT_UEVENT family
- Allow dhcpcd the kill capability
- Allow systemd-networkd list /var/lib/systemd/network
- Allow sysadm_t run systemd-nsresourced bpf programs
- Update policy for systemd generators interactions
- Allow create memory.pressure files with cgroup_memory_pressure_t
- Add support for libvirt hooks
* Wed Jun 19 2024 Zdenek Pytela <zpytela@redhat.com> - 41.6-1
- Allow certmonger read and write tpm devices
- Allow all domains to connect to systemd-nsresourced over a unix socket
- Allow systemd-machined read the vsock device
- Update policy for systemd generators
- Allow ptp4l_t request that the kernel load a kernel module
- Allow sbd to trace processes in user namespace
- Allow request-key execute scripts
- Update policy for haproxyd
* Tue Jun 18 2024 Zdenek Pytela <zpytela@redhat.com> - 41.5-1
- Update policy for systemd-nsresourced
- Correct sbin-related file context entries
* Mon Jun 17 2024 Zdenek Pytela <zpytela@redhat.com> - 41.4-1
- Allow login_userdomain execute systemd-tmpfiles in the caller domain
- Allow virt_driver_domain read files labeled unconfined_t
- Allow virt_driver_domain dbus chat with policykit
- Allow virtqemud manage nfs files when virt_use_nfs boolean is on
- Add rules for interactions between generators
- Label memory.pressure files with cgroup_memory_pressure_t
- Revert "Allow some systemd services write to cgroup files"
- Update policy for systemd-nsresourced
- Label /usr/bin/ntfsck with fsadm_exec_t
- Allow systemd_fstab_generator_t read tmpfs files
- Update policy for systemd-nsresourced
- Alias /usr/sbin to /usr/bin and change all /usr/sbin paths to /usr/bin
- Remove a few lines duplicated between {dkim,milter}.fc
- Alias /bin → /usr/bin and remove redundant paths
- Drop duplicate line for /usr/sbin/unix_chkpwd
- Drop duplicate paths for /usr/sbin
Automatic update for selinux-policy-41.7-1.fc41.
Automatic update for selinux-policy-41.6-1.fc41.
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2024-2711625691Please login to add feedback.
This update was automatically created
This update has obsoleted selinux-policy-41.7-1.fc41, and has inherited its bugs and notes.
This update's test gating status has been changed to 'waiting'.
Really?
/selinux-policy/fapolicyd-and-similaris a false positive as discussed earlier.This update's test gating status has been changed to 'failed'.
The failure is a false positive:
This is because the system is created with the previous version of the policy and the upgraded package is installed into it, but no relabel is done. We'd need the relabel to happen for the test to pass. We should push this package and then the subsequent tests will pass after it goes stable.
I installed the updated package and
/usr/sbin/httpdhas the correct context (system_u:object_r:httpd_exec_t:s0) after a relabel.This update's test gating status has been changed to 'waiting'.
This update's test gating status has been changed to 'passed'.
This update has been submitted for stable by bodhi
The openQA test does the following:
I do not understand where in that process you think the "false positive" is, @zbyszek . If a relabel is needed at some point during that process, it should not be openQA's (i.e. the sysadmin's) job to do it, it should be triggered by whatever update requires it.
As things stand I don't agree that this is a false positive, and indeed, now you waived this, subsequent updates are failing the same test in the same way, including FEDORA-2024-3aafcac6a8 which you were trying to unblock: https://openqa.fedoraproject.org/tests/2722892
The issue that causes the failure is the mislabelling caused by previous versions of selinux-policy. The problem was introduced recently (41.4-1), so to avoid the problem generally all that is needed is to skip the updates between that version and the latest update. Thus, I pushed the update with the hope that that'd actually resolve the issue once the latest update goes stable.
I don't think it's job of the update either. If my analysis is correct, the issue should be resolved by not installing the bad selinux-policy versions.
Hmm, https://openqa.fedoraproject.org/tests/2722892 failed because pciutils was rebuilt again outside of the side-tag and became FTI. So I don't think the latest failure is related to selinux at all.
Pfff, I put the text above with quotes to which I was replying… It doesn't make sense without them. Please read my reply in the email notification in case it's not clear ;]
"Hmm, https://openqa.fedoraproject.org/tests/2722892 failed because pciutils was rebuilt again outside of the side-tag and became FTI. So I don't think the latest failure is related to selinux at all."
Huh? No it didn't. It failed exactly the same way as this: ipa.service is failed because httpd service is failed, and httpd service is failed because "httpd: Could not open configuration file /etc/httpd/conf/httpd.conf: Permission denied". See https://openqa.fedoraproject.org/tests/2722892/file/role_deploy_domain_controller_check-var_log.tar.gz .
"The issue that causes the failure is the mislabelling caused by previous versions of selinux-policy. The problem was introduced recently (41.4-1), so to avoid the problem generally all that is needed is to skip the updates between that version and the latest update. Thus, I pushed the update with the hope that that'd actually resolve the issue once the latest update goes stable."
Looking at the logs from 2722892 , the only selinux policy versions that ever seem to be installed during the lifetime of that test are
selinux-policy-targeted-40.23-1.fc40.noarch(installed OOTB on the base F40 disk image) andselinux-policy-targeted-41.8-1.fc41.noarch(installed during the upgrade). No intermediate version ever appears to be installed. 40.23-1.fc40 is the current stable version for F40 - FEDORA-2024-2bc43119f3 - and passed all its tests.It appears httpd is upgraded before selinux-policy:
Could this be the source of the issue?
Oh, no, that upgrade only happens in the test of FEDORA-2024-3aafcac6a8 , the bin-sbin merge update. In the logs of the test on this update, httpd is downgraded, and it happens after selinux-policy is upgraded:
Aha. I did a scratch build of selinux-policy for F40 with "Drop the publicfile module" backported, ran the test again with that scratch build pulled in, and it seems to be passing. So I think perhaps we need that change on F39 and F40 too, and that should have happened before this landed.
I'm going to file a ticket requesting this update be untagged for now while we work this out, I don't want to try YOLOing selinux-policy builds for F39 and F40 myself.
Untag ticket: https://pagure.io/releng/issue/12197
Hmm, further note: I've now noticed that in the time this was stable, several F41 FreeIPA deployment tests (non-upgrade ones) failed due to failure to start httpd, e.g. this one. In the logs we see a denial:
and a corresponding httpd.service failure:
From the logs it seems selinux-policy started out as 41.3 and was updated to 41.8 during the initial update run at the start of the test, before FreeIPA server deployment is attempted. I don't know why we didn't see these failures on the tests of the selinux 41.8 update itself.
I don't quite understand the updates testing workflow, but in general, the issue with publicfile_t can only manifest when httpd starts with selinux-policy 41.3 to 41.7 installed.
tcontext=system_u:object_r:unlabeled_t:s0 tclass=file permissive=0 trawcon="system_u:object_r:publicfile_exec_t:s0"
may indicate the policy has been updated, so the label does not exist, but either the binary has not been relabeled or it is a deleted file. Relabeling should happen during %post phase.
Yeah, I don't under this either. In the images I looked into, the label is
http_exec_t. https://src.fedoraproject.org/rpms/selinux-policy/pull-request/445 is an attempt at a workaround.Well, I can't really comment on what "can't possibly happen" or whatever, but I know what did happen: in https://openqa.fedoraproject.org/tests/2722892 we installed FreeIPA (including httpd) with
selinux-policy-targeted-40.23-1.fc40.noarchand it worked, then we upgraded toselinux-policy-targeted-41.8-1.fc41.noarchand it failed. No other version ofselinux-policy-targetedwas installed during the lifetime of the test. You can check this yourself from https://openqa.fedoraproject.org/tests/2722892/file/role_deploy_domain_controller_check-var_log.tar.gz .You can see exactly the same in https://openqa.fedoraproject.org/tests/2723862 , the most recent run of the same test on this update. It installed FreeIPA with
selinux-policy-targeted-40.23-1.fc40.noarchand it worked, then it upgraded directly to Fedora 41 includingselinux-policy-targeted-41.8-1.fc41.noarchand it failed. You can see this in the dnf transaction log:There is no other version there.
I also verified, as I said, that if I backport the removal of
publicfileto Fedora 40, so when we install FreeIPA (httpd) on Fedora 40 it happens with an selinux-policy package with nopublicfilemodule, the test passes.