URL: https://github.com/SSSD/sssd/pull/457 Title: #457: ipa: Removal of umask(0) in selinux_child
lslebodn commented: """ On (15/01/18 09:28), Petr Lautrbach wrote:
[root@centos7 targeted]# rpm -q libsemanage libsemanage-2.5-8.el7.x86_64 [root@centos7 targeted]# ls -ld /etc/selinux/targeted/active/ /etc/selinux/targeted/active/modules/ drwx------. 3 root root 206 Jan 15 17:24 /etc/selinux/targeted/active/ drwx------. 4 root root 33 Jan 15 17:24 /etc/selinux/targeted/active/modules/ [root@centos7 targeted]# umask 777 [root@centos7 targeted]# semodule -B [root@centos7 targeted]# ls -ld /etc/selinux/targeted/active/ /etc/selinux/targeted/active/modules/ d---------. 3 root root 206 Jan 15 17:27 /etc/selinux/targeted/active/ d---------. 4 root root 33 Jan 15 17:27 /etc/selinux/targeted/active/modules/
I thought that upstream libsemanage-2.6 is safe but it isn't
``` [root@f26 ~]# ls -ld /var/lib/selinux/targeted/active/ /var/lib/selinux/targeted/active/modules/ drwx------. 3 root root 228 Jan 16 07:17 /var/lib/selinux/targeted/active/ drwx------. 6 root root 55 Jan 16 07:17 /var/lib/selinux/targeted/active/modules/ [root@f26 ~]# umask 777 [root@f26 ~]# semodule -B [root@f26 ~]# ls -ld /var/lib/selinux/targeted/active/ /var/lib/selinux/targeted/active/modules/ d---------. 3 root root 228 Jan 16 07:18 /var/lib/selinux/targeted/active/ d---------. 6 root root 55 Jan 16 07:18 /var/lib/selinux/targeted/active/modules/ [root@f26 ~]# rpm -q libsemanage libsemanage-2.6-4.fc26.x86_64 ```
and the same behaviour is also in rawhide ``` [root@rawhide ~]# rpm -q libsemanage libsemanage-2.7-5.fc28.x86_64 [root@rawhide ~]# ls -ld /var/lib/selinux/targeted/active/ drwx------. 3 root root 4096 Jan 15 12:18 /var/lib/selinux/targeted/active/ [root@rawhide ~]# ls -ld /var/lib/selinux/targeted/active/ /var/lib/selinux/targeted/active/modules/ drwx------. 3 root root 4096 Jan 15 12:18 /var/lib/selinux/targeted/active/ drwx------. 5 root root 4096 Jan 15 12:18 /var/lib/selinux/targeted/active/modules/ [root@ibm-x3650m4-01-vm-06 ~]# umask 777 [root@ibm-x3650m4-01-vm-06 ~]# semodule -B [root@ibm-x3650m4-01-vm-06 ~]# ls -ld /var/lib/selinux/targeted/active/ /var/lib/selinux/targeted/active/modules/ d---------. 3 root root 4096 Jan 16 07:24 /var/lib/selinux/targeted/active/ d---------. 5 root root 4096 Jan 16 07:24 /var/lib/selinux/targeted/active/modules/ ```
@bachradsusi, so we should not merge that without fixed version of libsemanage (ideal upstream) and then we can do some build time checks.
LS
"""
See the full comment at https://github.com/SSSD/sssd/pull/457#issuecomment-357945879