[BUG] Can not set selinux context if file has MCS category set
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
In file.managed I use the following to set selinux attributes:
- selinux:
seuser: system_u
serole: object_r
setype: container_file_t
serange: s0
If the file has MLC (Mult-Level Category) set (e.g.: system_u:object_r:container_file_t:s0:c283,c327) modules.file will fail with ValueError because of to many values to unpack.
Setup
(Please provide relevant configs and/or SLS files (be sure to remove sensitive info. There is no general set-up of Salt.)
Please be as specific as possible and give set-up details.
- on-prem machine
- VM (KVM/libvirt)
- onedir packaging
Multiple machines with Salt 3007.1 (bare metal and KVM) running AlmaLinux.
Steps to Reproduce the behavior
Try to check/set selinux attributes with file.managed or modules.file in general on a file which has MLC categories set.
Expected behavior
Selinux attributes can bet checked/set.
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)Salt Version:
Salt: 3007.1
Python Version:
Python: 3.10.14 (main, Apr 3 2024, 21:30:09) [GCC 11.2.0]
Dependency Versions:
cffi: 1.16.0
cherrypy: 18.8.0
dateutil: 2.8.2
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
Jinja2: 3.1.4
libgit2: Not Installed
looseversion: 1.3.0
M2Crypto: Not Installed
Mako: Not Installed
msgpack: 1.0.7
msgpack-pure: Not Installed
mysql-python: Not Installed
packaging: 23.1
pycparser: 2.21
pycrypto: Not Installed
pycryptodome: 3.19.1
pygit2: Not Installed
python-gnupg: 0.5.2
PyYAML: 6.0.1
PyZMQ: 25.1.2
relenv: 0.16.0
smmap: Not Installed
timelib: 0.3.0
Tornado: 6.3.3
ZMQ: 4.3.4
Salt Package Information:
Package Type: onedir
System Versions:
dist: almalinux 9.4 Seafoam Ocelot
locale: utf-8
machine: x86_64
release: 5.14.0-427.35.1.el9_4.x86_64
system: Linux
version: AlmaLinux 9.4 Seafoam Ocelot
Additional context
Quick and dirty solution/patch:
--- modules/file.py.bak 2024-09-24 10:28:18.523257716 +0000
+++ modules/file.py 2024-09-24 11:25:08.027541137 +0000
@@ -5412,6 +5412,7 @@
current_serole,
current_setype,
current_serange,
+ *current_secategory,
) = get_selinux_context(name).split(":")
log.debug(
"Current selinux context user:%s role:%s type:%s range:%s",
@@ -5493,6 +5494,7 @@
current_serole,
current_setype,
current_serange,
+ *current_secategory,
) = result.split(":")
except ValueError:
log.error("Unable to set current selinux attributes")
@@ -5950,6 +5952,7 @@
current_serole,
current_setype,
current_serange,
+ *current_secategory,
) = get_selinux_context(name).split(":")
log.debug(
"Current selinux context user:%s role:%s type:%s range:%s",
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in modules/file.py at the SELinux handling around the three locations shown in the issue, and reproduce the failure with a context containing MCS categories. Check how file.managed and modules.file parse the context, then verify that SELinux attributes can be checked and set without failing when categories are present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100