F17 yum/rpm not running groupadd in %pre scripts

[Chuck Anderson]

Forwarding here since I think this is an SELinux issue w/rpm running
%pre scripts.  See the two bugs below.

The "screen" package has this %pre script:

preinstall scriptlet (using /bin/sh):
/usr/sbin/groupadd -g 84 -r -f screen
:

These dontaudit AVCs appear when installing the package via yum and
the group doesn't get created:

# semodule -DB

# yum install screen
...
Running Transaction
  Installing : screen-4.1.0-0.9.20120314git3c2946.fc17.x86_64               1/1 
warning: group screen does not exist - using root
warning: group screen does not exist - using root

# grep -i avc audit/audit.log

type=AVC msg=audit(1344982418.400:148): avc:  denied  { read } for  pid=5725
comm="groupadd" path="/tmp/tmpdH4tic" dev="dm-5" ino=942811
scontext=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:rpm_tmp_t:s0 tclass=file
type=AVC msg=audit(1344982418.400:148): avc:  denied  { read } for  pid=5725
comm="groupadd" path="/tmp/tmpdH4tic" dev="dm-5" ino=942811
scontext=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:rpm_tmp_t:s0 tclass=file
type=AVC msg=audit(1344982418.445:149): avc:  denied  { search } for  pid=5725
comm="groupadd" name="contexts" dev="dm-5" ino=672610
scontext=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:default_context_t:s0 tclass=dir
type=AVC msg=audit(1344982418.445:150): avc:  denied  { search } for  pid=5725
comm="groupadd" name="contexts" dev="dm-5" ino=672610
scontext=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:default_context_t:s0 tclass=dir
type=AVC msg=audit(1344982418.445:151): avc:  denied  { search } for  pid=5725
comm="groupadd" name="contexts" dev="dm-5" ino=672610
scontext=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023
tcontext=system_u:object_r:default_context_t:s0 tclass=dir

Everything works correctly if I "setenforce 0" first.

Thanks.

----- Forwarded message from Chuck Anderson <cra(a)WPI.EDU&gt; -----

Date: Tue, 14 Aug 2012 15:30:33 -0400
From: Chuck Anderson <cra(a)WPI.EDU&gt;
To: For testing and quality assurance of Fedora releases
<test(a)lists.fedoraproject.org&gt;
Subject: F17 yum/rpm not running groupadd in %pre scripts
Precedence: list
Reply-To: For testing and quality assurance of Fedora releases
<test(a)lists.fedoraproject.org&gt;

I ran into a comedy of errors today after I did a new F17 installation
yesterday.  Here are a couple:

https://bugzilla.redhat.com/show_bug.cgi?id=848148
Error in PREIN scriptlet in rpm package wireshark-1.6.9-1.fc17.x86_64

(and why does yum still let the transaction succeed, creating problems
in the RPMDB, broken dependencies?)

https://bugzilla.redhat.com/show_bug.cgi?id=845671
"Directory '/var/run/screen' must have mode 777." when opening screen

(and why does systemd-tmpfiles completely fail to start when there is
a missing group--it should fail gracefully, allowing the other
tmpfiles stuff to run and the service as a whole to run)

Both of these are traceable to missing entries in /etc/group.  In the
former cae, there is an explicit "Error in PREIN" script during
instalation.  In the latter case, there is only a warning and
installation proceeds:

Running Transaction
  Installing : screen-4.1.0-0.9.20120314git3c2946.fc17.x86_64               1/1 
warning: group screen does not exist - using root
warning: group screen does not exist - using root

So what is going on with %pre not running groupadd properly?  Are there
any known issues in this area?

Thanks.
-- 
test mailing list
test(a)lists.fedoraproject.org
To unsubscribe:
https://admin.fedoraproject.org/mailman/listinfo/test

----- End forwarded message -----

[Chuck Anderson]

I found another casualty (libvirt-daemon) and the fix:

https://bugzilla.redhat.com/show_bug.cgi?id=844167

On Tue, Aug 14, 2012 at 06:22:51PM -0400, Chuck Anderson wrote:
>  Forwarding here since I think this is an SELinux issue w/rpm running
>  %pre scripts.  See the two bugs below.
>  
>  The "screen" package has this %pre script:
>  
>  preinstall scriptlet (using /bin/sh):
>  /usr/sbin/groupadd -g 84 -r -f screen

[Miroslav Grepl]

On 08/15/2012 05:29 AM, Chuck Anderson wrote:
>  I found another casualty (libvirt-daemon) and the fix:
>
>  https://bugzilla.redhat.com/show_bug.cgi?id=844167
>
>  On Tue, Aug 14, 2012 at 06:22:51PM -0400, Chuck Anderson wrote:
> > Forwarding here since I think this is an SELinux issue w/rpm running
> > %pre scripts.  See the two bugs below.
> >
> > The "screen" package has this %pre script:
> >
> > preinstall scriptlet (using /bin/sh):
> > /usr/sbin/groupadd -g 84 -r -f screen
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
Yes, we have a bug for
this issue. But great analysis. Thank you.

rabbitmq policy needs to be revisited

[Dominick Grift]

I just had a look at rabbitmq policy module and i think this needs to be
revisited

For one the file context specs are bad:

/usr/lib64/erlang/erts-5.8.5/bin/beam.*		--
gen_context(system_u:object_r:rabbitmq_beam_exec_t,s0)
/usr/lib64/erlang/erts-5.8.5/bin/epmd		--
gen_context(system_u:object_r:rabbitmq_epmd_exec_t,s0)

But that just the tip of the iceberg.

I did a repoquery -ql rabbitmq-server and determined that its totally
different.