rpmbuild and selinux

[Eric Tanguy]

Since the update this morning when i try to build a package using
rpmbuild i obtain this kind of errors in the log : 
Traitement des fichiers: libupnp-devel-1.4.0-1
file_contexts:  invalid context system_u:object_r:usr_t
file_contexts:  invalid context system_u:object_r:usr_t
file_contexts:  invalid context system_u:object_r:usr_t
file_contexts:  invalid context system_u:object_r:usr_t
file_contexts:  invalid context system_u:object_r:usr_t
file_contexts:  invalid context system_u:object_r:usr_t
file_contexts:  invalid context system_u:object_r:usr_t
file_contexts:  invalid context system_u:object_r:usr_t
file_contexts:  invalid context system_u:object_r:usr_t
file_contexts:  invalid context system_u:object_r:usr_t

someone could explain me why and how to solve this ?
Thanks
Eric

[Daniel J Walsh]

Eric Tanguy wrote:
> Since the update this morning when i try to build a package using
> rpmbuild i obtain this kind of errors in the log : 
> Traitement des fichiers: libupnp-devel-1.4.0-1
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
>
> someone could explain me why and how to solve this ?
> Thanks
> Eric
>
> --
> fedora-selinux-list mailing list
> [e-mail]
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list

What policy rpm do you have installed?

rpm -q selinux-policy

[Eric Tanguy]

Le mardi 20 juin 2006 à 17:08 -0400, Daniel J Walsh a écrit :
> Eric Tanguy wrote:
> > Since the update this morning when i try to build a package using
> > rpmbuild i obtain this kind of errors in the log : 
> > Traitement des fichiers: libupnp-devel-1.4.0-1
> > file_contexts:  invalid context system_u:object_r:usr_t
> > file_contexts:  invalid context system_u:object_r:usr_t
> > file_contexts:  invalid context system_u:object_r:usr_t
> > file_contexts:  invalid context system_u:object_r:usr_t
> > file_contexts:  invalid context system_u:object_r:usr_t
> > file_contexts:  invalid context system_u:object_r:usr_t
> > file_contexts:  invalid context system_u:object_r:usr_t
> > file_contexts:  invalid context system_u:object_r:usr_t
> > file_contexts:  invalid context system_u:object_r:usr_t
> > file_contexts:  invalid context system_u:object_r:usr_t
> >
> > someone could explain me why and how to solve this ?
> > Thanks
> > Eric
> >
> > --
> > fedora-selinux-list mailing list
> > [e-mail]
> > https://www.redhat.com/mailman/listinfo/fedora-selinux-list
>
> What policy rpm do you have installed?
>
> rpm -q selinux-policy

selinux-policy-2.2.43-4.fc5

but it seems it happened after the update of these packages : 
libselinux.i386 1.30.3-3.fc5
libselinux-python.i386 1.30.3-3.fc5

[Eric Tanguy]

Le mercredi 21 juin 2006 à 08:18 +0200, Eric Tanguy a écrit :
> Le mardi 20 juin 2006 à 17:08 -0400, Daniel J Walsh a écrit :
> > Eric Tanguy wrote:
> > > Since the update this morning when i try to build a package using
> > > rpmbuild i obtain this kind of errors in the log : 
> > > Traitement des fichiers: libupnp-devel-1.4.0-1
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > > file_contexts:  invalid context system_u:object_r:usr_t
> > >
> > > someone could explain me why and how to solve this ?
> > > Thanks
> > > Eric
> > >
> > > --
> > > fedora-selinux-list mailing list
> > > [e-mail]
> > > https://www.redhat.com/mailman/listinfo/fedora-selinux-list
> >
> > What policy rpm do you have installed?
> >
> > rpm -q selinux-policy
>
> selinux-policy-2.2.43-4.fc5
>
> but it seems it happened after the update of these packages : 
> libselinux.i386 1.30.3-3.fc5
> libselinux-python.i386 1.30.3-3.fc5

In fact this problem seems quite serious and occurs each time i try to
build a package.
Eric

[Stephen Smalley]

On Tue, 2006-06-20 at 22:28 +0200, Eric Tanguy wrote:
> Since the update this morning when i try to build a package using
> rpmbuild i obtain this kind of errors in the log : 
> Traitement des fichiers: libupnp-devel-1.4.0-1
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
> file_contexts:  invalid context system_u:object_r:usr_t
>
> someone could explain me why and how to solve this ?

Is this in a chroot?

If so, I suspect that this is a result of the !selinux_mnt patch to
libselinux; when I merged it upstream, I had to fix it to set errno
properly.

[Jason L Tibbitts III]

> > > > > "SS" == Stephen Smalley  writes:

SS> Is this in a chroot?

I am seeing the problem running a plain rpmbuild -ba, no chroot or
mock in sight.

- J<

[Daniel J Walsh]

Jason L Tibbitts III wrote:
> > > > > > "SS" == Stephen Smalley  writes:
>
> SS> Is this in a chroot?
>
> I am seeing the problem running a plain rpmbuild -ba, no chroot or
> mock in sight.
> J<

Is this happening selinux disabled?  There is a printf in libselinux 
which is triggered when matchpatcon fails
to verify a file context via the kernel.  If the kernel is not running 
selinux this could happen.

Dan

[Jason L Tibbitts III]

> > > > > "DJW" == Daniel J Walsh <Daniel> writes:

DJW> Is this happening selinux disabled?

Indeed it is.  These messages don't bother the package at all but they
did confuse me for a bit.

- J<

[Eric Tanguy]

Le mercredi 21 juin 2006 à 20:17 -0500, Jason L Tibbitts III a écrit :
> > > > > > "DJW" == Daniel J Walsh <Daniel> writes:
>
> DJW> Is this happening selinux disabled?
>
> Indeed it is.  These messages don't bother the package at all but they
> did confuse me for a bit.
> J<

I see the problem for all packages i try to build
selinux is enabled
at this time i didn't see the same problem using mock

[Stephen Smalley]

On Wed, 2006-06-21 at 21:13 -0400, Daniel J Walsh wrote:
> Jason L Tibbitts III wrote:
> > > > > > > "SS" == Stephen Smalley  writes:
> > > > > > >
> >
> > SS> Is this in a chroot?
> >
> > I am seeing the problem running a plain rpmbuild -ba, no chroot or
> > mock in sight.
> > J<
>
> Is this happening selinux disabled?  There is a printf in libselinux 
> which is triggered when matchpatcon fails
> to verify a file context via the kernel.  If the kernel is not running 
> selinux this could happen.

Normally that is suppressed because default_canoncon checks whether
security_canonicalize_context() returned with errno ENOENT
(i.e. /selinux/context didn't exist, as with SELinux disabled or in a
chroot).  But the patch from Ian Kent for !selinux_mnt changes that
behavior unless those checks also set errno to ENOENT, which I added
upstream, but is _not_ in your FC5 backport.

[Daniel J Walsh]

Stephen Smalley wrote:
> On Wed, 2006-06-21 at 21:13 -0400, Daniel J Walsh wrote:
> > Jason L Tibbitts III wrote:
> > > > > > >> "SS" == Stephen Smalley  writes:
> > > > > > >>             
> > > > > > >>
> > >
> > > SS> Is this in a chroot?
> > >
> > > I am seeing the problem running a plain rpmbuild -ba, no chroot or
> > > mock in sight.
> > > J<
> >
> > Is this happening selinux disabled?  There is a printf in libselinux 
> > which is triggered when matchpatcon fails
> > to verify a file context via the kernel.  If the kernel is not running 
> > selinux this could happen.
>
> Normally that is suppressed because default_canoncon checks whether
> security_canonicalize_context() returned with errno ENOENT
> (i.e. /selinux/context didn't exist, as with SELinux disabled or in a
> chroot).  But the patch from Ian Kent for !selinux_mnt changes that
> behavior unless those checks also set errno to ENOENT, which I added
> upstream, but is _not_ in your FC5 backport.

Fixed in libselinux-1_30_3-4_fc5