<!DOCTYPE html><html><head><title></title><style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div><span class="font" style="font-family:monospace;">Package: selinux-policy-default <br>X-Debbugs-Cc: <a href="mailto:blake@volian.org">blake@volian.org</a> <br>Version: 2:2.20240202-1 <br>Severity: important <br> <br>Hello, <br> <br>I have been messing around with configuring Debian with CIS controls and using SELinux.<br> <br>The first problem I've encountered is that having `/var` configured with `nosuid` option causes dpkg to break for scripts. An example of the error message with `apt install vim`.<br><br>```<br><span style="color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);">dpkg (subprocess): unable to execute new vim-runtime package pre-installation script (/var/lib/dpkg/<a href="http://tmp.ci/preinst">tmp.ci/preinst</a>): Permission denied </span><br>dpkg: error processing archive /var/cache/apt/archives/vim-runtime_2%3a9.1.0199-1_all.deb (--unpack): <br>new vim-runtime package pre-installation script subprocess returned error exit status 2 <br>dpkg (subprocess): unable to execute new vim-runtime package post-removal script (/var/lib/dpkg/<a href="http://tmp.ci/postrm">tmp.ci/postrm</a>): Permission denied <br>dpkg: error while cleaning up: <br>new vim-runtime package post-removal script subprocess returned error exit status 2<br>```<br> </span></div><div><br></div><div><span class="font" style="font-family:monospace;">`audit2why -a` gives me<br><br>```<br><span style="color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);">type=AVC msg=audit(1712517197.064:359): avc: denied { nosuid_transition } for pid=5633 comm="dpkg" scontext=unconfined_u:unconfined_r:dpkg_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:dpkg_script_t</span><br>:s0-s0:c0.c1023 tclass=process2 permissive=0<br>```<br><br>and then `audit2why -a` gives me<br><br>```<br><span style="color:rgb(0, 0, 0);background-color:rgb(255, 255, 255);">#============= dpkg_t ============== </span><br>allow dpkg_t dpkg_script_t:process2 nosuid_transition;<br>```<br> <br>I think due to the importance of dpkg in the Debian ecosystem this should probably be allowed in the global policy.<br><br>Also it seems that the salsa repository for refpolicy is not up-to-date with the package that is being distributed. Salsa still shows refpolicy 2022, but I'm seeing 2024 installed on my system. If this could be resolved I'd like to fork the repo and tinker with the policy.<br><br>Thanks,<br>Blake<br><br>-- System Information: <br>Debian Release: trixie/sid <br> APT prefers unstable <br> APT policy: (500, 'unstable') <br>Architecture: amd64 (x86_64) <br> <br>Kernel: Linux 6.7.9-amd64 (SMP w/4 CPU threads; PREEMPT) <br>Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set <br>Shell: /bin/sh linked to /usr/bin/dash <br>Init: systemd (via /run/systemd/system) <br>LSM: SELinux: enabled - Mode: Permissive - Policy name: default <br> <br>Versions of packages selinux-policy-default depends on: <br>ii libselinux1 3.5-2+b1 <br>ii libsemanage2 3.5-1+b3 <br>ii libsepol2 3.5-2 <br>ii policycoreutils 3.5-2 <br>ii selinux-utils 3.5-2+b1 <br> <br>Versions of packages selinux-policy-default recommends: <br>ii checkpolicy 3.5-1 <br>pn setools <none> <br> <br>Versions of packages selinux-policy-default suggests: <br>pn logcheck <none> <br>pn syslog-summary <none> <br> <br>-- no debconf information</span></div></body></html>