Possible SE Linux label bug in bluefin-dx:stable?

[murphym18]

Looks like SELinux is misconfigured on bluefin-dx:stable. When I get the default SELinux security context for my home directory from the file contexts configuration, the labels are wrong. As a result, SELinux labeling tools determine that my home directory should have the type default_t instead of user_home_dir_t. There are similar labeling errors for all the common sub-directories in ~/ (such as ~/Documents and ~/Music).

SELinux's file-context configuration appears to be missing the substitution needed to map /var/home to /home.

Here are the steps to reproduce:

1. Install bluefin-dx:stable.
2. In a terminal run this command:

   matchpathcon ~/Documents

Here's the expected output:

/var/home/user/Documents unconfined_u:object_r:user_home_t:s0

Actual output:

/var/home/user/Documents system_u:object_r:default_t:s0

Background

for context, matchpathcon answers the question: given the current SELinux file-context config, what should this file's label be?

In this case, user_home_t is the desired type for ~/Documents. The type should not be default_t.

Here's some background: SELinux includes policies that can protect your home directory from processes that should not have access to it. However, these policies only work as intended if your home directory is labeled Appropriately. In this case, your ~/Documents should be labeled with user_home_t.

When you first install bluefin, your home directory should already have the correct label. You can find out by running:

/bin/ls -Zd ~/Documents

# NOTE: if you ran `ujust bluefin-cli` then you can run this instead:
ls -lZd ~/Documents

You should see that your home directory has the label:

unconfined_u:object_r:user_home_t:s0 

But you might run into labeling issues going forward because the system thinks your home directory (and ~/Documents) ought to be labeled with the type default_t.

You're more likely to run into issues when you mount your home directory (or a sub-directory) into a container. For example, if you create a Podman Quadlet that bind-mounts a directory such as ~/Documents into a container with the :z option. In that case your ~/Documents directory gets relabeled in order to enable your container to access the contents. The problem shows up when your container exits. Sometimes that relabeling persists after the container exits. If that happens you might want to relabel your directory.

Normally you should be able to restore your SELinux label(s) by running restorecon. For example:

restorecon -Rv ~/Documents

This program is supposed to find the correct label and apply it. However, this program won't work on bluefin-dx. Basically, restorecon cannot reliably restore the intended home-directory labels because SELinux's file-context configuration says that /var/home/user/Documents should be default_t.

Please note, it's not just the ~/Documents directory, it's the entire home directory and all its sub-directories. Here are some other examples:

matchpathcon ~
matchpathcon ~/Documents
matchpathcon ~/Music

Some Other Thoughts

Note

This problem does not exist in bluefin. I only observed the problem in bluefin-dx

I think I was able to track the problem down to this file:

/etc/selinux/targeted/contexts/files/file_contexts.subs_dist

On Bluefin (non-dx) this file has a special fix. But on bluefin-dx this special fix isn't present.

To figure out what's going on, I ran this command on bluefin-dx and bluefin:

rpm -qf /etc/selinux/targeted/contexts/files/file_contexts.subs_dist

• Bluefin-dx includes selinux-policy-targeted-44.8-1.fc44.noarch
• Bluefin includes selinux-policy-targeted-44.4-1.fc44.noarch

The working version in bluefin includes comments around the fix and it links to this:
coreos/rpm-ostree#1754 (comment) (someone previously found this issue)

I tried to download the special version of this package in bluefin:

selinux-policy-targeted-44.5-1.fc44.noarch

but I couldn't find it online:
https://rpmfind.net/linux/rpm2html/search.php?query=selinux-policy-targeted&submit=Search+...&system=&arch=

By the way, I attached a copy of Bluefin's file_contexts.subs_dist (this is the working version).

Here's a diff:

Bluefin on the left (working version), Bluefin-dx on the right (broken version)

28c28,29
< /var/home            /home
---
> # https://github.com/projectatomic/rpm-ostree/pull/1754
> # /var/home            /home
38a40,45
> # https://github.com/projectatomic/rpm-ostree/pull/1754
> /home /var/home
> # https://github.com/coreos/rpm-ostree/pull/5485
> /usr/etc/systemd/system /usr/lib/systemd/system
> # https://github.com/coreos/rpm-ostree/pull/1795
> /usr/lib/opt /opt

file_contexts.subs_dist.txt