Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #61865 > unrolled thread

Bug#906729: Please fix SELinux labels of /vmlinuz symlink after kernel update

Back to article view | Back to linux.debian.kernel

Contents

  Bug#906729: Please fix SELinux labels of /vmlinuz symlink after kernel update Laurent Bigonville <bigon@debian.org> - 2018-08-20 11:40 +0200
    Processed: Re: Bug#906729: Please fix SELinux labels of /vmlinuz  symlink after kernel update "Debian Bug Tracking System" <owner@bugs.debian.org> - 2018-08-21 02:10 +0200
    Bug#906729: Please fix SELinux labels of /vmlinuz symlink after kernel update Ben Hutchings <ben@decadent.org.uk> - 2018-08-21 02:10 +0200
    Bug#906729: Please fix SELinux labels of /vmlinuz symlink after kernel update Christian Göttsche <cgzones@googlemail.com> - 2020-01-25 19:50 +0100
      Bug#906729: Please fix SELinux labels of /vmlinuz symlink after kernel update bauen1 <j2468h@googlemail.com> - 2020-12-05 13:50 +0100

#61865 — Bug#906729: Please fix SELinux labels of /vmlinuz symlink after kernel update

Package: linux-base
Version: 4.5
Severity: normal
File: /usr/bin/linux-update-symlinks
User: selinux-devel@lists.alioth.debian.org
Usertags: selinux

Hi,

After updating the kernel it seems that the /vmlinuz(.old) and
/initrd.img(.old) symlinks are deleted and then recreated.

This means that the SELinux label of these symlinks should be reset.

The easiest way of doing that is (as there are no perl bindings) to call
restorecon executable if the executable is installed on the machine as
it handel the case were selinux is disabled on the machine gracefully

ie. restorecon /vmlinuz

Kind regards,

Laurent Bigonville

-- System Information:
Debian Release: buster/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'unstable'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.17.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_BE.UTF-8, LC_CTYPE=fr_BE.UTF-8 (charmap=UTF-8), LANGUAGE=fr_BE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: SELinux: enabled - Mode: Permissive - Policy name: refpolicy

Versions of packages linux-base depends on:
ii  debconf [debconf-2.0]  1.5.69

linux-base recommends no packages.

linux-base suggests no packages.

-- debconf information:
  linux-base/removing-title:
  linux-base/removing-running-kernel: true

[toc] | [next] | [standalone]

#61873 — Processed: Re: Bug#906729: Please fix SELinux labels of /vmlinuz symlink after kernel update

Processing control commands:

> tag -1 moreinfo
Bug #906729 [linux-base] Please fix SELinux labels of /vmlinuz symlink after kernel update
Added tag(s) moreinfo.

-- 
906729: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906729
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#61875

[Multipart message — attachments visible in raw view] — view raw

Control: tag -1 moreinfo

On Mon, 2018-08-20 at 11:36 +0200, Laurent Bigonville wrote:
> Package: linux-base
> Version: 4.5
> Severity: normal
> File: /usr/bin/linux-update-symlinks
> User: selinux-devel@lists.alioth.debian.org
> Usertags: selinux
> 
> Hi,
> 
> After updating the kernel it seems that the /vmlinuz(.old) and
> /initrd.img(.old) symlinks are deleted and then recreated.
> 
> This means that the SELinux label of these symlinks should be reset.
> 
> The easiest way of doing that is (as there are no perl bindings) to call
> restorecon executable if the executable is installed on the machine as
> it handel the case were selinux is disabled on the machine gracefully
> 
> ie. restorecon /vmlinuz

Why is this needed?  Only boot loaders should be using these symlinks
and they don't know or care about SELinux stuff.

Ben.

-- 
Ben Hutchings
For every action, there is an equal and opposite criticism. - Harrison

[toc] | [prev] | [next] | [standalone]

#66206

It is not needed for anything to work correctly; it is just that
objects should have the context defined by the SELinux policy. The
root_t context should only be used by the root path directory,
anything else is suspicious and should be avoided. Also if one sets up
an alert for incorrect labeled objects (e.g. via repeatedly running
restorecon -v -R -n /) this mislabeling would trigger.


--- /var/lib/dpkg/info/linux-image-5.4.0-3-amd64.postinst
2020-01-19 10:22:58.000000000 +0100
+++ /root/workspace/linux-image-5.4.0-3-amd64.postinst  2020-01-25
19:29:15.264928445 +0100
@@ -15,6 +15,8 @@
     change=upgrade
 fi
 linux-update-symlinks $change $version $image_path
+# set SELinux context (#906729)
+which restorecon >/dev/null 2>&1 && restorecon /vmlinuz /initrd.img
 rm -f /lib/modules/$version/.fresh-install

 if [ -d /etc/kernel/postinst.d ]; then

[toc] | [prev] | [next] | [standalone]

#68767

On Sat, 25 Jan 2020 19:42:53 +0100 =?UTF-8?Q?Christian_G=C3=B6ttsche?= <cgzones@googlemail.com> wrote:
> It is not needed for anything to work correctly; it is just that
> objects should have the context defined by the SELinux policy. The
> root_t context should only be used by the root path directory,
> anything else is suspicious and should be avoided. Also if one sets up
> an alert for incorrect labeled objects (e.g. via repeatedly running
> restorecon -v -R -n /) this mislabeling would trigger.

Even better would be if the linux-update-symlinks perl script fixed the symlinks label before replacing it in an atomic operation in https://salsa.debian.org/kernel-team/linux-base/-/blob/master/bin/linux-update-symlinks#L49-76

-- 

bauen1
https://dn42.bauen1.xyz/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web