Jira (PUP-7073) Comparisons between SELinux file categories should always translate to the numeric version

[Branan Riley (JIRA)]

Title: Message Title

Branan Riley commented on PUP-7073   Re: Comparisons between SELinux file categories should always translate to the numeric version I can't reproduce this on Centos 7. Commented interactive test follows, possibly I missed something # Purge HTTPD configuration from last time [root@cti10id5k3z311t ~]# rm -rf /etc/httpd   # Verify mcstransd is running correctly [root@cti10id5k3z311t ~]# systemctl status mcstransd ● mcstransd.service - Daemon used to translate SELinux MCS/MLS labels to human readable form Loaded: loaded (/usr/lib/systemd/system/mcstransd.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2017-01-17 12:02:04 PST; 3min 10s ago Main PID: 643 (mcstransd) CGroup: /system.slice/mcstransd.service └─643 /usr/sbin/mcstransd   Jan 17 12:02:04 cti10id5k3z311t systemd[1]: Starting Daemon used to translate SELinux MCS/MLS labels to human readable form... Jan 17 12:02:04 cti10id5k3z311t mcstransd[633]: /usr/sbin/mcstransd starting Jan 17 12:02:04 cti10id5k3z311t mcstransd[643]: /usr/sbin/mcstransd initialized Jan 17 12:02:04 cti10id5k3z311t systemd[1]: Started Daemon used to translate SELinux MCS/MLS labels to human readable form.   # Set up apache with puppet [root@cti10id5k3z311t ~]# puppet apply apache.pp Notice: Compiled catalog for cti10id5k3z311t.delivery.puppetlabs.net in environment production in 1.66 seconds Notice: /Stage[main]/Apache/Package[httpd]/ensure: created Notice: /Stage[main]/Apache/File[/etc/httpd/conf.d/README]/ensure: removed Notice: /Stage[main]/Apache/File[/etc/httpd/conf.d/autoindex.conf]/ensure: removed Notice: /Stage[main]/Apache/File[/etc/httpd/conf.d/userdir.conf]/ensure: removed Notice: /Stage[main]/Apache/File[/etc/httpd/conf.d/welcome.conf]/ensure: removed Notice: /Stage[main]/Apache::Mod::Mime/File[mime.conf]/ensure: defined content as '{md5}9da85e58f3bd6c780ce76db603b7f028' Notice: /Stage[main]/Apache::Mod::Mime_magic/File[mime_magic.conf]/ensure: defined content as '{md5}b258529b332429e2ff8344f726a95457' Notice: /Stage[main]/Apache::Mod::Alias/File[alias.conf]/ensure: defined content as '{md5}983e865be85f5e0daaed7433db82995e' Notice: /Stage[main]/Apache::Mod::Autoindex/File[autoindex.conf]/ensure: defined content as '{md5}2421a3c6df32c7e38c2a7a22afdf5728' Notice: /Stage[main]/Apache::Mod::Deflate/File[deflate.conf]/ensure: defined content as '{md5}a045d750d819b1e9dae3fbfb3f20edd5' Notice: /Stage[main]/Apache::Mod::Dir/File[dir.conf]/ensure: defined content as '{md5}c741d8ea840e6eb999d739eed47c69d7' Notice: /Stage[main]/Apache::Mod::Negotiation/File[negotiation.conf]/ensure: defined content as '{md5}47284b5580b986a6ba32580b6ffb9fd7' Notice: /Stage[main]/Apache::Mod::Setenvif/File[setenvif.conf]/ensure: defined content as '{md5}c7ede4173da1915b7ec088201f030c28' Notice: /Stage[main]/Apache::Mod::Prefork/File[/etc/httpd/conf.modules.d/prefork.conf]/ensure: defined content as '{md5}109c4f51dac10fc1b39373855e566d01' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[log_config]/File[log_config.load]/ensure: defined content as '{md5}785d35cb285e190d589163b45263ca89' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[systemd]/File[systemd.load]/ensure: defined content as '{md5}26e5d44aae258b3e9d821cbbbd3e2826' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[unixd]/File[unixd.load]/ensure: defined content as '{md5}0e8468ecc1265f8947b8725f4d1be9c0' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[authz_host]/File[authz_host.load]/ensure: defined content as '{md5}d1045f54d2798499ca0f030ca0eef920' Notice: /Stage[main]/Apache::Mod::Actions/Apache::Mod[actions]/File[actions.load]/ensure: defined content as '{md5}599866dfaf734f60f7e2d41ee8235515' Notice: /Stage[main]/Apache::Mod::Authn_core/Apache::Mod[authn_core]/File[authn_core.load]/ensure: defined content as '{md5}704d6e8b02b0eca0eba4083960d16c52' Notice: /Stage[main]/Apache::Mod::Cache/Apache::Mod[cache]/File[cache.load]/ensure: defined content as '{md5}01e4d392225b518a65b0f7d6c4e21d29' Notice: /Stage[main]/Apache::Mod::Ext_filter/Apache::Mod[ext_filter]/File[ext_filter.load]/ensure: defined content as '{md5}76d5e0ac3411a4be57ac33ebe2e52ac8' Notice: /Stage[main]/Apache::Mod::Mime/Apache::Mod[mime]/File[mime.load]/ensure: defined content as '{md5}e36257b9efab01459141d423cae57c7c' Notice: /Stage[main]/Apache::Mod::Mime_magic/Apache::Mod[mime_magic]/File[mime_magic.load]/ensure: defined content as '{md5}cb8670bb2fb352aac7ebf3a85d52094c' Notice: /Stage[main]/Apache::Mod::Rewrite/Apache::Mod[rewrite]/File[rewrite.load]/ensure: defined content as '{md5}26e2683352fc1599f29573ff0d934e79' Notice: /Stage[main]/Apache::Mod::Speling/Apache::Mod[speling]/File[speling.load]/ensure: defined content as '{md5}f82e9e6b871a276c324c9eeffcec8a61' Notice: /Stage[main]/Apache::Mod::Suexec/Apache::Mod[suexec]/File[suexec.load]/ensure: defined content as '{md5}c7d5c61c534ba423a79b0ae78ff9be35' Notice: /Stage[main]/Apache::Mod::Version/Apache::Mod[version]/File[version.load]/ensure: defined content as '{md5}1c9243de22ace4dc8266442c48ae0c92' Notice: /Stage[main]/Apache::Mod::Vhost_alias/Apache::Mod[vhost_alias]/File[vhost_alias.load]/ensure: defined content as '{md5}eca907865997d50d5130497665c3f82e' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[auth_digest]/File[auth_digest.load]/ensure: defined content as '{md5}df9e85f8da0b239fe8e698ae7ead4f60' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[authn_anon]/File[authn_anon.load]/ensure: defined content as '{md5}bf57b94b5aec35476fc2a2dc3861f132' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[authn_dbm]/File[authn_dbm.load]/ensure: defined content as '{md5}90ee8f8ef1a017cacadfda4225e10651' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[authz_dbm]/File[authz_dbm.load]/ensure: defined content as '{md5}c1363277984d22f99b70f7dce8753b60' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[authz_owner]/File[authz_owner.load]/ensure: defined content as '{md5}f30a9be1016df87f195449d9e02d1857' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[expires]/File[expires.load]/ensure: defined content as '{md5}f0825bad1e470de86ffabeb86dcc5d95' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[include]/File[include.load]/ensure: defined content as '{md5}88095a914eedc3c2c184dd5d74c3954c' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[logio]/File[logio.load]/ensure: defined content as '{md5}084533c7a44e9129d0e6df952e2472b6' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[substitute]/File[substitute.load]/ensure: defined content as '{md5}8077c34a71afcf41c8fc644830935915' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[usertrack]/File[usertrack.load]/ensure: defined content as '{md5}e95fbbf030fabec98b948f8dc217775c' Notice: /Stage[main]/Apache::Mod::Alias/Apache::Mod[alias]/File[alias.load]/ensure: defined content as '{md5}3cf2fa309ccae4c29a4b875d0894cd79' Notice: /Stage[main]/Apache::Mod::Authn_file/Apache::Mod[authn_file]/File[authn_file.load]/ensure: defined content as '{md5}d41656680003d7b890267bb73621c60b' Notice: /Stage[main]/Apache::Mod::Autoindex/Apache::Mod[autoindex]/File[autoindex.load]/ensure: defined content as '{md5}515cdf5b573e961a60d2931d39248648' Notice: /Stage[main]/Apache::Mod::Dav/Apache::Mod[dav]/File[dav.load]/ensure: defined content as '{md5}588e496251838c4840c14b28b5aa7881' Notice: /Stage[main]/Apache::Mod::Dav_fs/File[dav_fs.conf]/ensure: defined content as '{md5}899a57534f3d84efa81887ec93c90c9b' Notice: /Stage[main]/Apache::Mod::Dav_fs/Apache::Mod[dav_fs]/File[dav_fs.load]/ensure: defined content as '{md5}2996277c73b1cd684a9a3111c355e0d3' Notice: /Stage[main]/Apache::Mod::Deflate/Apache::Mod[deflate]/File[deflate.load]/ensure: defined content as '{md5}2d1a1afcae0c70557251829a8586eeaf' Notice: /Stage[main]/Apache::Mod::Dir/Apache::Mod[dir]/File[dir.load]/ensure: defined content as '{md5}1bfb1c2a46d7351fc9eb47c659dee068' Notice: /Stage[main]/Apache::Mod::Negotiation/Apache::Mod[negotiation]/File[negotiation.load]/ensure: defined content as '{md5}d262ee6a5f20d9dd7f87770638dc2ccd' Notice: /Stage[main]/Apache::Mod::Setenvif/Apache::Mod[setenvif]/File[setenvif.load]/ensure: defined content as '{md5}ec6c99f7cc8e35bdbcf8028f652c9f6d' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[auth_basic]/File[auth_basic.load]/ensure: defined content as '{md5}494bcf4b843f7908675d663d8dc1bdc8' Notice: /Stage[main]/Apache::Mod::Filter/Apache::Mod[filter]/File[filter.load]/ensure: defined content as '{md5}66a1e2064a140c3e7dca7ac33877700e' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[authz_core]/File[authz_core.load]/ensure: defined content as '{md5}39942569bff2abdb259f9a347c7246bc' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[access_compat]/File[access_compat.load]/ensure: defined content as '{md5}d5feb88bec4570e2dbc41cce7e0de003' Notice: /Stage[main]/Apache::Mod::Authz_user/Apache::Mod[authz_user]/File[authz_user.load]/ensure: defined content as '{md5}63594303ee808423679b1ea13dd5a784' Notice: /Stage[main]/Apache::Default_mods/Apache::Mod[authz_groupfile]/File[authz_groupfile.load]/ensure: defined content as '{md5}ae005a36b3ac8c20af36c434561c8a75' Notice: /Stage[main]/Apache::Mod::Env/Apache::Mod[env]/File[env.load]/ensure: defined content as '{md5}d74184d40d0ee24ba02626a188ee7e1a' Notice: /Stage[main]/Apache::Mod::Prefork/Apache::Mpm[prefork]/File[/etc/httpd/conf.modules.d/prefork.load]/ensure: defined content as '{md5}157529aafcf03fa491bc924103e4608e' Notice: /Stage[main]/Apache::Mod::Cgi/Apache::Mod[cgi]/File[cgi.load]/ensure: defined content as '{md5}ac20c5c5779b37ab06b480d6485a0881' Notice: /Stage[main]/Apache/File[/etc/httpd/conf.modules.d/00-base.conf]/ensure: removed Notice: /Stage[main]/Apache/File[/etc/httpd/conf.modules.d/00-dav.conf]/ensure: removed Notice: /Stage[main]/Apache/File[/etc/httpd/conf.modules.d/00-lua.conf]/ensure: removed Notice: /Stage[main]/Apache/File[/etc/httpd/conf.modules.d/00-mpm.conf]/ensure: removed Notice: /Stage[main]/Apache/File[/etc/httpd/conf.modules.d/00-proxy.conf]/ensure: removed Notice: /Stage[main]/Apache/File[/etc/httpd/conf.modules.d/00-systemd.conf]/ensure: removed Notice: /Stage[main]/Apache/File[/etc/httpd/conf.modules.d/01-cgi.conf]/ensure: removed Notice: /Stage[main]/Main/Apache::Vhost[vhost.example.com]/Concat[25-vhost.example.com.conf]/File[/etc/httpd/conf.d/25-vhost.example.com.conf]/ensure: defined content as '{md5}3ea49b3ea23bcc115180a1a58da955e8' Notice: /Stage[main]/Apache/Concat[/etc/httpd/conf/ports.conf]/File[/etc/httpd/conf/ports.conf]/ensure: defined content as '{md5}334fa5cddbf9a408ea1ca7a1666b1fc4' Notice: /Stage[main]/Apache/File[/etc/httpd/conf/httpd.conf]/content: content changed '{md5}f5e7449c0f17bc856e86011cb5d152ba' to '{md5}fe21e50f7d52267e70e1ac13d9233dd3' Notice: /Stage[main]/Apache::Service/Service[httpd]/ensure: ensure changed 'stopped' to 'running' Notice: Applied catalog in 4.09 seconds   # Examine the selinux attributes on our vhost file [root@cti10id5k3z311t ~]# getfattr -n security.selinux /etc/httpd/conf.d/25-vhost.example.com.conf getfattr: Removing leading '/' from absolute path names # file: etc/httpd/conf.d/25-vhost.example.com.conf security.selinux="system_u:object_r:httpd_config_t:s0"   [root@cti10id5k3z311t ~]# ls -Z /etc/httpd/conf.d/25-vhost.example.com.conf -rw-r--r--. root root system_u:object_r:httpd_config_t:SystemLow /etc/httpd/conf.d/25-vhost.example.com.conf   # re-run puppet to confirm it's stable [root@cti10id5k3z311t ~]# puppet apply apache.pp Notice: Compiled catalog for cti10id5k3z311t.delivery.puppetlabs.net in environment production in 1.45 seconds Notice: Applied catalog in 0.66 seconds   # Remount /proc to break things [root@cti10id5k3z311t ~]# mount -o remount,hidepid=2,gid=10 /proc   # Confirm mcstransd is busted [root@cti10id5k3z311t ~]# systemctl status mcstransd ● mcstransd.service - Daemon used to translate SELinux MCS/MLS labels to human readable form Loaded: loaded (/usr/lib/systemd/system/mcstransd.service; enabled; vendor preset: disabled) Active: active (running) since Tue 2017-01-17 12:02:04 PST; 4min 26s ago Main PID: 643 (mcstransd) CGroup: /system.slice/mcstransd.service └─643 /usr/sbin/mcstransd   Jan 17 12:02:04 cti10id5k3z311t systemd[1]: Starting Daemon used to translate SELinux MCS/MLS labels to human readable form... Jan 17 12:02:04 cti10id5k3z311t mcstransd[633]: /usr/sbin/mcstransd starting Jan 17 12:02:04 cti10id5k3z311t mcstransd[643]: /usr/sbin/mcstransd initialized Jan 17 12:02:04 cti10id5k3z311t systemd[1]: Started Daemon used to translate SELinux MCS/MLS labels to human readable form. Jan 17 12:06:31 cti10id5k3z311t mcstransd[643]: Failed to get context of client process (pid=1) Jan 17 12:06:31 cti10id5k3z311t mcstransd[643]: Servicing of request failed for fd (6) Jan 17 12:06:31 cti10id5k3z311t mcstransd[643]: Failed to get context of client process (pid=1) Jan 17 12:06:31 cti10id5k3z311t mcstransd[643]: Servicing of request failed for fd (6)   # Apply our manifest one more time... [root@cti10id5k3z311t ~]# puppet apply apache.pp Notice: Compiled catalog for cti10id5k3z311t.delivery.puppetlabs.net in environment production in 1.47 seconds Notice: Applied catalog in 0.66 seconds   # Puppet didn't change anything, but we can see that ls -Z now shows the numeric s0 instead of SystemLow (since mcstransd is dead) [root@cti10id5k3z311t ~]# ls -Z /etc/httpd/conf.d/25-vhost.example.com.conf -rw-r--r--. root root system_u:object_r:httpd_config_t:s0 /etc/httpd/conf.d/25-vhost.example.com.conf [root@cti10id5k3z311t ~]# getfattr -n security.selinux /etc/httpd/conf.d/25-vhost.example.com.conf getfattr: Removing leading '/' from absolute path names # file: etc/httpd/conf.d/25-vhost.example.com.conf security.selinux="system_u:object_r:httpd_config_t:s0" My manifest is a bare-minimum apache setup, so maybe there's more I need to add? class { 'apache': default_vhost => false, }   apache::vhost { 'vhost.example.com': port => '80', docroot => '/var/www/vhost', } Add Comment   This message was sent by Atlassian JIRA (v6.4.14#64029-sha1:ae256fe) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.