saltstack / saltstack/salt

[BUG] Can not set selinux context if file has MCS category set

Open
#66,921 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
In file.managed I use the following to set selinux attributes:

- selinux:
        seuser: system_u
        serole: object_r
        setype: container_file_t
        serange: s0

If the file has MLC (Mult-Level Category) set (e.g.: system_u:object_r:container_file_t:s0:c283,c327) modules.file will fail with ValueError because of to many values to unpack.

Setup
(Please provide relevant configs and/or SLS files (be sure to remove sensitive info. There is no general set-up of Salt.)

Please be as specific as possible and give set-up details.

  • on-prem machine
  • VM (KVM/libvirt)
  • onedir packaging

Multiple machines with Salt 3007.1 (bare metal and KVM) running AlmaLinux.

Steps to Reproduce the behavior
Try to check/set selinux attributes with file.managed or modules.file in general on a file which has MLC categories set.

Expected behavior
Selinux attributes can bet checked/set.

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
          Salt: 3007.1
 
Python Version:
        Python: 3.10.14 (main, Apr  3 2024, 21:30:09) [GCC 11.2.0]
 
Dependency Versions:
          cffi: 1.16.0
      cherrypy: 18.8.0
      dateutil: 2.8.2
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 3.1.4
       libgit2: Not Installed
  looseversion: 1.3.0
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.7
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 23.1
     pycparser: 2.21
      pycrypto: Not Installed
  pycryptodome: 3.19.1
        pygit2: Not Installed
  python-gnupg: 0.5.2
        PyYAML: 6.0.1
         PyZMQ: 25.1.2
        relenv: 0.16.0
         smmap: Not Installed
       timelib: 0.3.0
       Tornado: 6.3.3
           ZMQ: 4.3.4
 
Salt Package Information:
  Package Type: onedir
 
System Versions:
          dist: almalinux 9.4 Seafoam Ocelot
        locale: utf-8
       machine: x86_64
       release: 5.14.0-427.35.1.el9_4.x86_64
        system: Linux
       version: AlmaLinux 9.4 Seafoam Ocelot

Additional context

Quick and dirty solution/patch:

--- modules/file.py.bak 2024-09-24 10:28:18.523257716 +0000
+++ modules/file.py     2024-09-24 11:25:08.027541137 +0000
@@ -5412,6 +5412,7 @@
                 current_serole,
                 current_setype,
                 current_serange,
+                *current_secategory,
             ) = get_selinux_context(name).split(":")
             log.debug(
                 "Current selinux context user:%s role:%s type:%s range:%s",
@@ -5493,6 +5494,7 @@
                             current_serole,
                             current_setype,
                             current_serange,
+                            *current_secategory,
                         ) = result.split(":")
                     except ValueError:
                         log.error("Unable to set current selinux attributes")
@@ -5950,6 +5952,7 @@
                     current_serole,
                     current_setype,
                     current_serange,
+                    *current_secategory,
                 ) = get_selinux_context(name).split(":")
                 log.debug(
                     "Current selinux context user:%s role:%s type:%s range:%s",

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in modules/file.py at the SELinux handling around the three locations shown in the issue, and reproduce the failure with a context containing MCS categories. Check how file.managed and modules.file parse the context, then verify that SELinux attributes can be checked and set without failing when categories are present.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.