| Summary: | Broken setfile prevents emerge of sys-apps/policycoreutils to fix issue | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | MarisN <maris.gis> |
| Component: | Hardened | Assignee: | Robin Johnson <robbat2> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | selinux, swift |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
MarisN
2011-09-27 08:16:09 UTC
Does rebuilding with FEATURES="-selinux" work? (In reply to comment #1) > Does rebuilding with FEATURES="-selinux" work? Can't check, as I fixed system by copying compiled setfiles file and reruning emerge. You don't happen to have any output logs of failures? I'm interesting in knowing what exactly failed. (In reply to comment #3) > You don't happen to have any output logs of failures? I'm interesting in > knowing what exactly failed. Unfortunately I was too worried about getting my system back into shape and was not thinking about later failure analysis :( Judging by my emerge.log, failure was caused by emerge world doing an upgrade from sys-process/audit-1.7.4 to sys-process/audit-2.1.3 Here are steps to reproduce issue: emerge =sys-process/audit-1.7.4 setfiles <- now this command fails. Let's fix it by reemerging it: emerge sys-apps/policycoreutils >>> Setting SELinux security labels /usr/sbin/setfiles: error while loading shared libraries: libaudit.so.1: cannot open shared object file: No such file or directory Aha, thanks. I'll check what we can do about this, but I think it'll be a documentation enhancement (can't imagine an immediate solution to make sure this never happens, unless we can temporarily keep the "old" so files, rebuild, hope they link with the "new" so files and only then remove it). I'm not familiar with setfiles and how portage uses it, still wouldn't be possible to use a new setfiles version to run it after emerging of policycoreutils and thus relay only on known good version of file? (In reply to comment #5) > Aha, thanks. > > I'll check what we can do about this, but I think it'll be a documentation > enhancement (can't imagine an immediate solution to make sure this never > happens, unless we can temporarily keep the "old" so files, rebuild, hope they > link with the "new" so files and only then remove it). Not really; the "new" setfiles would be built by policycoreutils, and portage would first need to relabel it before it can use it. But since the old setfiles doesn't work, and the new setfiles isn't properly labeled, you'll hit the same problem anyhow. I think the best way to go forward is to use FEATURES="-selinux" emerge policycoreutils, something we do during the SELinux installation as well. Then, you can use "rlpkg policycoreutils" to relabel the package. The rlpkg package uses the python bindings rather than the setfiles command so probably suffices in this case. But that's based on (insufficient) knowledge, so I'll first see if I can reproduce ;) Okay, easily reproduceable.
For starters, I'll document this as a FAQ using the following text:
>>>
Portage fails to label files because "setfiles" does not work anymore
Portage uses the setfiles command to set the labels of the files it installs. However, that command is a dynamically linked executable, so any update in its depending libraries (libselinux.so, libsepol.so, libaudit.so and of course libc.so) might cause for the application to fail. Gentoo's standard solution (revdep-rebuild) will not work, since the tool will try to rebuild policycoreutils, which will fail to install because Portage cannot set the file labels.
The solution is to rebuild policycoreutils while disabling Portage' selinux support, then label the installed files manually using chcon, based on the feedback received from matchpathcon.
Code Listing 5.14: Recovering from Portage installation failures
# FEATURES="-selinux" emerge --oneshot policycoreutils
# for FILE in $(qlist policycoreutils); do \
CONTEXT=$(matchpathcon -n ${FILE}) chcon ${CONTEXT} ${FILE}; done
<<<
I'll see if we can somehow provide a technical fix as well, but I'm not sure there is (a proper) one.
Robin, Is it possible for sys-process/audit to preserve_old_lib on /usr/lib(64)?/libaudit.so.0 ? If the file disappears during the audit upgrade, setfiles breaks, which causes Portage to break on SELinux. This is now handled by FEATURES="preserve-lib" so we can continue safely now ;-) |
