selinux policy absent states fail when trying to remove a semodule policy defined entry
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
We migrated some local selinux customizations into a semodule policy file, and now when trying to verify they are removed, we get state errors. Since this happens for any policy defined inside an semodule policy, I can reproduce this with a standard policy entry defined in the selinux reference policy.
Setup
/srv/salt/bugreport.sls
'/root/bin(/.*)? bin_t':
selinux.fcontext_policy_absent:
- sel_type: 'bin_t'
- filetype: a
- name: '/root/bin(/.*)?'
Steps to Reproduce the behavior
salt-call --local state.sls bugreport
local:
----------
ID: /root/bin(/.*)? bin_t
Function: selinux.fcontext_policy_absent
Name: /root/bin(/.*)?
Result: False
Comment: Error removing policy: {'pid': 7630, 'retcode': 1, 'stdout': '', 'stderr': 'ValueError: File context for /root/bin(/.*)? is defined in policy, cannot be deleted'}
Started: 12:43:33.344391
Duration: 4650.64 ms
Changes:
----------
new:
----------
old:
----------
/root/bin(/.*)?:
----------
filespec:
/root/bin(/.*)?
filetype:
all files
sel_level:
s0
sel_role:
object_r
sel_type:
bin_t
sel_user:
system_u
Summary for local
------------
Succeeded: 0 (changed=1)
Failed: 1
------------
Total states run: 1
Total run time: 4.651 s
Expected behavior
I expect the state to not fail when trying to remove a policy defined inside an semodule policy.
Screenshots
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)Salt Version:
Salt: 3002.1
Dependency Versions:
cffi: 1.9.1
cherrypy: Not Installed
dateutil: 2.4.2
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 2.11.2
libgit2: 0.28.4
M2Crypto: 0.35.2
Mako: 1.1.3
msgpack-pure: Not Installed
msgpack-python: 0.6.2
mysql-python: Not Installed
pycparser: 2.20
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: 1.0.3
Python: 3.6.8 (default, Sep 26 2019, 11:57:09)
python-gnupg: Not Installed
PyYAML: 5.3.1
PyZMQ: 19.0.1
smmap: Not Installed
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.3.2
System Versions:
dist: rhel 7.8 Maipo
locale: UTF-8
machine: x86_64
release: 3.10.0-1127.19.1.el7.x86_64
system: Linux
version: Red Hat Enterprise Linux Server 7.8 Maipo
Additional context
According to the manage pages for semanage fcontext and semanage port, the -C or --locallist argument limits the actions to only the local customizations.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the selinux.fcontext_policy_absent state and reproduce the behavior using /srv/salt/bugreport.sls and salt-call --local state.sls bugreport. Check how semanage handles policy-defined entries versus local customizations; done means removing a semodule-defined entry no longer fails while local entries are handled correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- devops, operating-systems, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100