[DSE-Dev] Bug#1068601: selinux-policy-default: /var with nosuid and SELinux enabled breaks dpkg

[Blake Lee]

Package: selinux-policy-default 
X-Debbugs-Cc: blake at volian.org 
Version: 2:2.20240202-1 
Severity: important 

Hello, 

I have been messing around with configuring Debian with CIS controls and using SELinux.

The first problem I've encountered is that having `/var` configured with `nosuid` option causes dpkg to break for scripts. An example of the error message with `apt install vim`.

```
dpkg (subprocess): unable to execute new vim-runtime package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied 
dpkg: error processing archive /var/cache/apt/archives/vim-runtime_2%3a9.1.0199-1_all.deb (--unpack): 
new vim-runtime package pre-installation script subprocess returned error exit status 2 
dpkg (subprocess): unable to execute new vim-runtime package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied 
dpkg: error while cleaning up:  
new vim-runtime package post-removal script subprocess returned error exit status 2
```

`audit2why -a` gives me

```
type=AVC msg=audit(1712517197.064:359): avc:  denied  { nosuid_transition } for  pid=5633 comm="dpkg" scontext=unconfined_u:unconfined_r:dpkg_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:dpkg_script_t
:s0-s0:c0.c1023 tclass=process2 permissive=0
```

and then `audit2why -a` gives me

```
#============= dpkg_t ============== 
allow dpkg_t dpkg_script_t:process2 nosuid_transition;
```

I think due to the importance of dpkg in the Debian ecosystem this should probably be allowed in the global policy.

Also it seems that the salsa repository for refpolicy is not up-to-date with the package that is being distributed. Salsa still shows refpolicy 2022, but I'm seeing 2024 installed on my system. If this could be resolved I'd like to fork the repo and tinker with the policy.

Thanks,
Blake

-- System Information: 
Debian Release: trixie/sid 
 APT prefers unstable 
 APT policy: (500, 'unstable') 
Architecture: amd64 (x86_64) 

Kernel: Linux 6.7.9-amd64 (SMP w/4 CPU threads; PREEMPT) 
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set 
Shell: /bin/sh linked to /usr/bin/dash 
Init: systemd (via /run/systemd/system) 
LSM: SELinux: enabled - Mode: Permissive - Policy name: default 

Versions of packages selinux-policy-default depends on: 
ii  libselinux1      3.5-2+b1 
ii  libsemanage2     3.5-1+b3 
ii  libsepol2        3.5-2 
ii  policycoreutils  3.5-2 
ii  selinux-utils    3.5-2+b1 

Versions of packages selinux-policy-default recommends: 
ii  checkpolicy  3.5-1 
pn  setools      <none> 

Versions of packages selinux-policy-default suggests: 
pn  logcheck        <none> 
pn  syslog-summary  <none> 

-- no debconf information
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/selinux-devel/attachments/20240407/6699029f/attachment.htm>