From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-hackers@lists.postgresql.org
cc: Joe Conway <mail@joeconway.com>
Subject: sepgsql seems rather thoroughly broken on Fedora 30
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <23855.1563381159.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 17 Jul 2019 12:32:39 -0400
Message-ID: <23856.1563381159@sss.pgh.pa.us>
Precedence: bulk

I tried to run the contrib/sepgsql tests, following the instructions,
on a recently-set-up Fedora 30 machine.  I've done that successfully
on previous Fedora releases, but it's no go with F30.

First off, building the sepgsql-regtest.pp policy file spews
a bunch of complaints that I don't recall having seen before:

$ make -f /usr/share/selinux/devel/Makefile =

/usr/share/selinux/devel/include/services/container.if:14: Error: duplicat=
e definition of container_runtime_domtrans(). Original definition on 14.
/usr/share/selinux/devel/include/services/container.if:41: Error: duplicat=
e definition of container_runtime_run(). Original definition on 41.
/usr/share/selinux/devel/include/services/container.if:61: Error: duplicat=
e definition of container_runtime_exec(). Original definition on 61.
/usr/share/selinux/devel/include/services/container.if:80: Error: duplicat=
e definition of container_read_state(). Original definition on 80.
... more of the same ...
/usr/share/selinux/devel/include/services/container.if:726: Error: duplica=
te definition of docker_stream_connect(). Original definition on 726.
/usr/share/selinux/devel/include/services/container.if:730: Error: duplica=
te definition of docker_spc_stream_connect(). Original definition on 730.
/usr/share/selinux/devel/include/services/container.if:744: Error: duplica=
te definition of container_spc_read_state(). Original definition on 744.
/usr/share/selinux/devel/include/services/container.if:763: Error: duplica=
te definition of container_domain_template(). Original definition on 763.
/usr/share/selinux/devel/include/services/container.if:791: Error: duplica=
te definition of container_spc_rw_pipes(). Original definition on 791.
Compiling targeted sepgsql-regtest module
Creating targeted sepgsql-regtest.pp policy package
rm tmp/sepgsql-regtest.mod tmp/sepgsql-regtest.mod.fc
$

The sepgsql-regtest.pp file is created anyway, and it seems to
load into the kernel OK, so maybe these are harmless?  Or not.

I got through the remaining steps OK, until getting to actually
running the test script:

$ ./test_sepgsql =


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D checking selinux environment   =
        =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
checking for matchpathcon           ... ok
checking for runcon                 ... ok
checking for sestatus               ... ok
checking current user domain        ... unconfined_t
checking selinux operating mode     ... enforcing
checking for sepgsql-regtest policy ... ok
checking whether policy is enabled  ... on
on
checking whether we can run psql    ... failed

/home/tgl/testversion/bin/psql must be executable from the
sepgsql_regtest_user_t domain. That domain has restricted privileges
compared to unconfined_t, so the problem may be the psql file's
SELinux label. Try

  $ sudo restorecon -R /home/tgl/testversion/bin

Or, using chcon

  $ sudo chcon -t user_home_t /home/tgl/testversion/bin/psql


(BTW, what's that extra "on" after "checking whether policy is enabled"?)

psql does already have that labeling according to "ls -Z",
so unsurprisingly, the recommended remediation doesn't help.

Trying to drill down a bit, I did what the script is doing:

$ runcon -t sepgsql_regtest_user_t psql --help
psql: fatal: could not look up effective user ID 1000: user does not exist

But uid 1000 is me according to /etc/passwd and according to "id":

$ id
uid=3D1000(tgl) gid=3D1000(tgl) groups=3D1000(tgl),10(wheel) context=3Dunc=
onfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

so there's nothing much wrong with having that as euid.

I speculate that the policy is forbidding sepgsql_regtest_user_t
from reading /etc/passwd.  Perhaps this is fallout from the
compile problems reported for the policy module?  But I'm way
out of my depth here.

I'm pretty sure the test recipe last worked for me on F28.
Off to try F29.

			regards, tom lane