Uploaded image for project: 'Facter'
  1. Facter
  2. FACT-1477

SELinux fact not being correctly detected

    Details

    • CS Priority:
      Reviewed
    • Release Notes:
      Bug Fix
    • Release Notes Summary:
      Facter now indicates if SELinux is enabled on the system by also checking for the existence of the /etc/selinux/config file in addition to checking for the presence of the SELinux filesystem.

      Description

      I'm working with a user who had to write their own fact to parse the output of sestatus. I was surprised and did a little digging. They have found that on their systems, Facter says that SE Linux is enabled but permissive. However, it is disabled. (I assume that some kernel module is loaded that causes the appropriate /sys data to be populated, but SE Linux is not enabled)

      Here's the code for our SE Linux fact:

      https://github.com/puppetlabs/facter/blob/4a495e877d68648b6315b1a68755627de4c3c52d/lib/src/facts/linux/operating_system_resolver.cc#L61

      Basically, the assumptions are not true for this user:

      [root@rhel7 ~]# facter -p selinux
      true
      [root@rhel7 ~]# grep selinuxfs /proc/self/mounts
      selinuxfs /sys/fs/selinux selinuxfs rw,relatime 0 0

      [root@rhel7 facter]# cat /sys/fs/selinux/enforce
      0

      [root@rhel7 ~]# getenforce
      Disabled
      [root@rhel7 ~]# sestatus
      SELinux status: disabled

      So basically, the code seems to indicate that if /sys/fs/selinux exists, the SE linux is enabled and if /sys/fs/selinux/enforce is zero, that it's in permissive mode.

      However, as can be plainly seen, getenforce and sestatus both show that SE Linux is disabled, but both would say permissive if that were the case

      I suggest that if our SE Linux fact disagrees with getenforce and sestatus, we should probably change our fact.

        Attachments

          Activity

            jsd-sla-details-panel

              People

              • Assignee:
                Unassigned
                Reporter:
                paul.anderson Paul Anderson
              • Votes:
                1 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated: