Uploaded image for project: 'Puppet'
  1. Puppet
  2. PUP-1747

Selinux parsing with multiple levels

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Accepted
    • Priority: Normal
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Template:
    • Team:
      Night's Watch

      Description

      The parsing portion of set_selinux_context(file, value, component = false) does not account for multiple levels/sensitivities. The range component can contain a ":" on MLS systems for example

      "unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c255
      user : role : type : range "

      When the function splits on ":" it causes only the first part of the range to be reset, and the second half to be preserved. This makes the selrange to grow indefinitely

      Example:
      Initial

      • security.selinux="system_u:object_r:auditd_log_t:s15:c0.c16383"
        After 1 puppet run
      • security.selinux="system_u:object_r:auditd_log_t:s15:c0.c16383:c0.c16383"
        etc.

      I have attached a patch that seems to fix it on my system, but the parse_selinux_context() function seems to do it better, so i'll leave it up to people with more ruby-fu than I have

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              Unassigned Unassigned
              Reporter:
              mruge Matt Ruge
              Votes:
              2 Vote for this issue
              Watchers:
              4 Start watching this issue

                Dates

                Created:
                Updated:

                  Zendesk Support