saltstack / saltstack/salt

selinux policy absent states fail when trying to remove a semodule policy defined entry

Open
#58,900 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug severity-medium
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
We migrated some local selinux customizations into a semodule policy file, and now when trying to verify they are removed, we get state errors. Since this happens for any policy defined inside an semodule policy, I can reproduce this with a standard policy entry defined in the selinux reference policy.

Setup
/srv/salt/bugreport.sls

'/root/bin(/.*)? bin_t':
  selinux.fcontext_policy_absent:
    - sel_type: 'bin_t'
    - filetype: a
    - name: '/root/bin(/.*)?'

Steps to Reproduce the behavior
salt-call --local state.sls bugreport

local:
----------
          ID: /root/bin(/.*)? bin_t
    Function: selinux.fcontext_policy_absent
        Name: /root/bin(/.*)?
      Result: False
     Comment: Error removing policy: {'pid': 7630, 'retcode': 1, 'stdout': '', 'stderr': 'ValueError: File context for /root/bin(/.*)? is defined in policy, cannot be deleted'}
     Started: 12:43:33.344391
    Duration: 4650.64 ms
     Changes:
              ----------
              new:
                  ----------
              old:
                  ----------
                  /root/bin(/.*)?:
                      ----------
                      filespec:
                          /root/bin(/.*)?
                      filetype:
                          all files
                      sel_level:
                          s0
                      sel_role:
                          object_r
                      sel_type:
                          bin_t
                      sel_user:
                          system_u

Summary for local
------------
Succeeded: 0 (changed=1)
Failed:    1
------------
Total states run:     1
Total run time:   4.651 s

Expected behavior
I expect the state to not fail when trying to remove a policy defined inside an semodule policy.

Screenshots

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
           Salt: 3002.1

Dependency Versions:
           cffi: 1.9.1
       cherrypy: Not Installed
       dateutil: 2.4.2
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
         Jinja2: 2.11.2
        libgit2: 0.28.4
       M2Crypto: 0.35.2
           Mako: 1.1.3
   msgpack-pure: Not Installed
 msgpack-python: 0.6.2
   mysql-python: Not Installed
      pycparser: 2.20
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: 1.0.3
         Python: 3.6.8 (default, Sep 26 2019, 11:57:09)
   python-gnupg: Not Installed
         PyYAML: 5.3.1
          PyZMQ: 19.0.1
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.3.2

System Versions:
           dist: rhel 7.8 Maipo
         locale: UTF-8
        machine: x86_64
        release: 3.10.0-1127.19.1.el7.x86_64
         system: Linux
        version: Red Hat Enterprise Linux Server 7.8 Maipo

Additional context

According to the manage pages for semanage fcontext and semanage port, the -C or --locallist argument limits the actions to only the local customizations.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the selinux.fcontext_policy_absent state and reproduce the behavior using /srv/salt/bugreport.sls and salt-call --local state.sls bugreport. Check how semanage handles policy-defined entries versus local customizations; done means removing a semodule-defined entry no longer fails while local entries are handled correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
devops, operating-systems, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.