Details
-
Bug
-
Status: Accepted
-
Normal
-
Resolution: Unresolved
-
None
-
None
-
None
-
Night's Watch
Description
The parsing portion of set_selinux_context(file, value, component = false) does not account for multiple levels/sensitivities. The range component can contain a ":" on MLS systems for example
"unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c255
user : role : type : range "
When the function splits on ":" it causes only the first part of the range to be reset, and the second half to be preserved. This makes the selrange to grow indefinitely
Example:
Initial
- security.selinux="system_u:object_r:auditd_log_t:s15:c0.c16383"
After 1 puppet run - security.selinux="system_u:object_r:auditd_log_t:s15:c0.c16383:c0.c16383"
etc.
I have attached a patch that seems to fix it on my system, but the parse_selinux_context() function seems to do it better, so i'll leave it up to people with more ruby-fu than I have
Attachments
Issue Links
- is duplicated by
-
PUP-3849 set_selinux_context needs parameter checks
-
- Closed
-