Regression in selabel_lookup after "rework selabel_file database"

Regression in selabel_lookup after "rework selabel_file database"

[Petr Lautrbach]

Hi,

we have a report [1] that in specific cases local fcontext modifications
are not considered or correctly resolved in `selabel_lookup`:

    [root@default-0 selinux]# matchpathcon /usr/bin/cloud-init
    /usr/bin/cloud-init     system_u:object_r:cloud_init_exec_t:s0
    [root@default-0 selinux]# semanage fcontext -a -t bin_t /usr/bin/cloud-init
    [root@default-0 selinux]# semanage fcontext -l -C
    SELinux fcontext                                   type               Context
    
    /usr/bin/cloud-init                                all files          system_u:object_r:bin_t:s0 
    [root@default-0 selinux]# matchpathcon /usr/bin/cloud-init
    /usr/bin/cloud-init     system_u:object_r:cloud_init_exec_t:s0


The bad commit seems to be 92306daf5219e73f6 ("libselinux: rework selabel_file(5) database")

Please take a look.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2360183

Thanks,

Petr

Re: Regression in selabel_lookup after "rework selabel_file database"

[Christian Göttsche]

On Wed, 16 Apr 2025 at 22:01, Petr Lautrbach <lautrbach@redhat.com> wrote:
>
> Hi,
>
> we have a report [1] that in specific cases local fcontext modifications
> are not considered or correctly resolved in `selabel_lookup`:
>
>     [root@default-0 selinux]# matchpathcon /usr/bin/cloud-init
>     /usr/bin/cloud-init     system_u:object_r:cloud_init_exec_t:s0
>     [root@default-0 selinux]# semanage fcontext -a -t bin_t /usr/bin/cloud-init
>     [root@default-0 selinux]# semanage fcontext -l -C
>     SELinux fcontext                                   type               Context
>
>     /usr/bin/cloud-init                                all files          system_u:object_r:bin_t:s0
>     [root@default-0 selinux]# matchpathcon /usr/bin/cloud-init
>     /usr/bin/cloud-init     system_u:object_r:cloud_init_exec_t:s0
>
>
> The bad commit seems to be 92306daf5219e73f6 ("libselinux: rework selabel_file(5) database")

Should be resolved by
https://lore.kernel.org/selinux/20250417190812.41263-1-cgoettsche@seltendoof.de/T/#u

Note that depending on the original file context defintion in order to
take priority one might need to specify the file type (i.e. add the
semanage arguments `-f f`).

> Please take a look.
>
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=2360183
>
> Thanks,
>
> Petr
>

Re: Regression in selabel_lookup after "rework selabel_file database"

[James Carter]

On Thu, Apr 17, 2025 at 3:36 PM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> On Wed, 16 Apr 2025 at 22:01, Petr Lautrbach <lautrbach@redhat.com> wrote:
> >
> > Hi,
> >
> > we have a report [1] that in specific cases local fcontext modifications
> > are not considered or correctly resolved in `selabel_lookup`:
> >
> >     [root@default-0 selinux]# matchpathcon /usr/bin/cloud-init
> >     /usr/bin/cloud-init     system_u:object_r:cloud_init_exec_t:s0
> >     [root@default-0 selinux]# semanage fcontext -a -t bin_t /usr/bin/cloud-init
> >     [root@default-0 selinux]# semanage fcontext -l -C
> >     SELinux fcontext                                   type               Context
> >
> >     /usr/bin/cloud-init                                all files          system_u:object_r:bin_t:s0
> >     [root@default-0 selinux]# matchpathcon /usr/bin/cloud-init
> >     /usr/bin/cloud-init     system_u:object_r:cloud_init_exec_t:s0
> >
> >
> > The bad commit seems to be 92306daf5219e73f6 ("libselinux: rework selabel_file(5) database")
>
> Should be resolved by
> https://lore.kernel.org/selinux/20250417190812.41263-1-cgoettsche@seltendoof.de/T/#u
>
> Note that depending on the original file context defintion in order to
> take priority one might need to specify the file type (i.e. add the
> semanage arguments `-f f`).
>

No, it should work like it did before.

After testing, it seems like the bug only occurs when neither the path
in the policy nor the path in the fcontext has a regex in it. If
either, or both do, then it works as expected.

Jim

> > Please take a look.
> >
> > [1] https://bugzilla.redhat.com/show_bug.cgi?id=2360183
> >
> > Thanks,
> >
> > Petr
> >
>