[DSE-Dev] Bug#1068601: selinux-policy-default: /var with nosuid and SELinux enabled breaks dpkg
Blake Lee
blake at volian.org
Sun Apr 7 20:38:45 BST 2024
Package: selinux-policy-default
X-Debbugs-Cc: blake at volian.org
Version: 2:2.20240202-1
Severity: important
Hello,
I have been messing around with configuring Debian with CIS controls and using SELinux.
The first problem I've encountered is that having `/var` configured with `nosuid` option causes dpkg to break for scripts. An example of the error message with `apt install vim`.
```
dpkg (subprocess): unable to execute new vim-runtime package pre-installation script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive /var/cache/apt/archives/vim-runtime_2%3a9.1.0199-1_all.deb (--unpack):
new vim-runtime package pre-installation script subprocess returned error exit status 2
dpkg (subprocess): unable to execute new vim-runtime package post-removal script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
new vim-runtime package post-removal script subprocess returned error exit status 2
```
`audit2why -a` gives me
```
type=AVC msg=audit(1712517197.064:359): avc: denied { nosuid_transition } for pid=5633 comm="dpkg" scontext=unconfined_u:unconfined_r:dpkg_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:dpkg_script_t
:s0-s0:c0.c1023 tclass=process2 permissive=0
```
and then `audit2why -a` gives me
```
#============= dpkg_t ==============
allow dpkg_t dpkg_script_t:process2 nosuid_transition;
```
I think due to the importance of dpkg in the Debian ecosystem this should probably be allowed in the global policy.
Also it seems that the salsa repository for refpolicy is not up-to-date with the package that is being distributed. Salsa still shows refpolicy 2022, but I'm seeing 2024 installed on my system. If this could be resolved I'd like to fork the repo and tinker with the policy.
Thanks,
Blake
-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.7.9-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: SELinux: enabled - Mode: Permissive - Policy name: default
Versions of packages selinux-policy-default depends on:
ii libselinux1 3.5-2+b1
ii libsemanage2 3.5-1+b3
ii libsepol2 3.5-2
ii policycoreutils 3.5-2
ii selinux-utils 3.5-2+b1
Versions of packages selinux-policy-default recommends:
ii checkpolicy 3.5-1
pn setools <none>
Versions of packages selinux-policy-default suggests:
pn logcheck <none>
pn syslog-summary <none>
-- no debconf information
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/selinux-devel/attachments/20240407/6699029f/attachment.htm>
More information about the SELinux-devel
mailing list