selinux_restore_tty: use fgetfilecon_raw/fsetfilecon_raw

[ghost]

Sudo uses fgetfilecon() and fsetfilecon() in selinux_restore_tty()
It should probably use fgetfilecon_raw() and fsetfilecon_raw() instead.

If you use mcstrans (a daemon that translates SELinux contexts to human readable strings), and you run shutdown -h now from a sudo -r sysadm.role -s shell then systemd will kill mcstrans before the sudo shell process gets killed.

Sudo, i think, still has the translated version of the context (retrieved with fgetfilecon()) in cache and tries to restore the context of the tty using the human readable version of the context. Since mcstrans is no longer present, that context is invalid prompting:

12:39 < grift> Dec 11 12:36:20 perfevent audit: SELINUX_ERR op=setxattr 
               invalid_context="wheel.id:wheel.role:users.terminals.pty.pty_file:SystemLow"
12:39 < grift> Dec 11 12:36:20 perfevent audit[859]: AVC avc:  denied  { mac_admin } for  pid=859 comm="sudo" capability=33  
               scontext=wheel.id:wheel.role:sudo.wheel.subj:s0 tcontext=wheel.id:wheel.role:sudo.wheel.subj:s0 tclass=capability2 permissive=0

By using fgetfilecon_raw() and fsetfilecon_raw() sudo would be using the "raw" context to restore the tty. This "raw" context is valid when mcstrans has been terminated.

[ToddMiller1]

Can you try the attached patch? I don't have an SELinux policy that actually cares about file contexts.
fsetfilecon_raw.txt

[ghost]

Thanks, Yes this patch fixes the above issue for me.

[millert]

I committed the patch; it will be in sudo the 1.8.30 release.