URL: https://github.com/SSSD/sssd/pull/457 Title: #457: ipa: Removal of umask(0) in selinux_child
lslebodn commented: """ On (15/01/18 09:28), Petr Lautrbach wrote: >[root@centos7 targeted]# rpm -q libsemanage >libsemanage-2.5-8.el7.x86_64 >[root@centos7 targeted]# ls -ld /etc/selinux/targeted/active/ >/etc/selinux/targeted/active/modules/ >drwx------. 3 root root 206 Jan 15 17:24 /etc/selinux/targeted/active/ > >drwx------. 4 root root 33 Jan 15 17:24 /etc/selinux/targeted/active/modules/ > >[root@centos7 targeted]# umask 777 >[root@centos7 targeted]# semodule -B >[root@centos7 targeted]# ls -ld /etc/selinux/targeted/active/ >/etc/selinux/targeted/active/modules/ >d---------. 3 root root 206 Jan 15 17:27 /etc/selinux/targeted/active/ >d---------. 4 root root 33 Jan 15 17:27 /etc/selinux/targeted/active/modules/ I thought that upstream libsemanage-2.6 is safe but it isn't ``` [root@f26 ~]# ls -ld /var/lib/selinux/targeted/active/ /var/lib/selinux/targeted/active/modules/ drwx------. 3 root root 228 Jan 16 07:17 /var/lib/selinux/targeted/active/ drwx------. 6 root root 55 Jan 16 07:17 /var/lib/selinux/targeted/active/modules/ [root@f26 ~]# umask 777 [root@f26 ~]# semodule -B [root@f26 ~]# ls -ld /var/lib/selinux/targeted/active/ /var/lib/selinux/targeted/active/modules/ d---------. 3 root root 228 Jan 16 07:18 /var/lib/selinux/targeted/active/ d---------. 6 root root 55 Jan 16 07:18 /var/lib/selinux/targeted/active/modules/ [root@f26 ~]# rpm -q libsemanage libsemanage-2.6-4.fc26.x86_64 ``` and the same behaviour is also in rawhide ``` [root@rawhide ~]# rpm -q libsemanage libsemanage-2.7-5.fc28.x86_64 [root@rawhide ~]# ls -ld /var/lib/selinux/targeted/active/ drwx------. 3 root root 4096 Jan 15 12:18 /var/lib/selinux/targeted/active/ [root@rawhide ~]# ls -ld /var/lib/selinux/targeted/active/ /var/lib/selinux/targeted/active/modules/ drwx------. 3 root root 4096 Jan 15 12:18 /var/lib/selinux/targeted/active/ drwx------. 5 root root 4096 Jan 15 12:18 /var/lib/selinux/targeted/active/modules/ [root@ibm-x3650m4-01-vm-06 ~]# umask 777 [root@ibm-x3650m4-01-vm-06 ~]# semodule -B [root@ibm-x3650m4-01-vm-06 ~]# ls -ld /var/lib/selinux/targeted/active/ /var/lib/selinux/targeted/active/modules/ d---------. 3 root root 4096 Jan 16 07:24 /var/lib/selinux/targeted/active/ d---------. 5 root root 4096 Jan 16 07:24 /var/lib/selinux/targeted/active/modules/ ``` @bachradsusi, so we should not merge that without fixed version of libsemanage (ideal upstream) and then we can do some build time checks. LS """ See the full comment at https://github.com/SSSD/sssd/pull/457#issuecomment-357945879
_______________________________________________ sssd-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
