The attached patch fixes at least one aspect of this problem. If dpkg is not going to abort on an error (not sure when/why this happens) such that ohshit() doesn't abort, then we still have a problem.
I experimented with modifying the ohshit() function, but that meant that dpkg-query needed to be linked against libselinux. One possible solution to that would be to have source file that contains ohshit() compiled twice, once for dpkg-query (without SE Linux support) and once with SE Linux support for dpkg. I would be happy to hack on some code for this if given guidance by dpkg developers, but am hesitant to write anything significant that isn't likely to be accepted. Incidentally one aspect of this bug is that on a strict system it may get into a state where "restorecon -R -v /var/lib/dpkg" is required to make apt work (otherwise apt would abort with EPERM). -- Russell Coker <[email protected]> http://etbe.coker.com.au/ My Blog http://etbe.coker.com.au/category/security/ My Security blog posts http://www.coker.com.au/selinux/play.html My Play Machine, root PW "SELINUX"
diff -ru dpkg-1.14.25.bak/debian/changelog dpkg-1.14.25/debian/changelog --- dpkg-1.14.25.bak/debian/changelog 2009-02-17 10:53:04.000000000 +1100 +++ dpkg-1.14.25/debian/changelog 2009-02-17 11:02:08.000000000 +1100 @@ -1,3 +1,11 @@ +dpkg (1.14.25-1) unstable; urgency=low + + * Call setfscreatecon(NULL) after installing a SE Linux labelled file + so that dpkg internal files don't get the wrong context. + Closes: #498438 + + -- Russell Coker <[email protected]> Tue, 17 Feb 2009 10:53:10 +1100 + dpkg (1.14.25) unstable; urgency=low [ Guillem Jover ] diff -ru dpkg-1.14.25.bak/src/archives.c dpkg-1.14.25/src/archives.c --- dpkg-1.14.25.bak/src/archives.c 2009-02-17 10:53:04.000000000 +1100 +++ dpkg-1.14.25/src/archives.c 2009-02-17 11:32:40.000000000 +1100 @@ -745,6 +745,11 @@ if (nifd->namenode->flags & fnnf_new_conff) { debug(dbg_conffdetail,"tarobject conffile extracted"); nifd->namenode->flags |= fnnf_elide_other_lists; +#ifdef WITH_SELINUX + if (selinux_enabled > 0) + if(setfscreatecon(NULL) < 0) + perror("Error restoring default security context:"); +#endif return 0; }
