Issue

What were you trying to do that didn't work? y What is the impact of this issue to you? Dogtag PKI cannot be installed with custom names. Please provide the package NVR for which the bug is seen: [root@pki1 pki]# rpm -qa | grep selinux libselinux-utils-2.9-9.el8_10.x86_64 selinux-policy-3.14.3-139.el8_10.1.noarch libselinux-2.9-9.el8_10.x86_64 python3-libselinux-2.9-9.el8_10.x86_64 rpm-plugin-selinux-4.14.3-32.el8_10.x86_64 selinux-policy-targeted-3.14.3-139.el8_10.1.noarch How reproducible is this bug?: Steps to reproduce Create a folder in /etc/pki called test and a file inside. Copy the following script in the VM (this perform similar action done inside DogtagPKI code): #!/usr/bin/python3 import sys import selinux import seobject def update_context(file_dir, new_context): suffix = '(/.*)?' trans = seobject.semanageRecords('targeted') trans.start() fcon = seobject.fcontextRecords(trans) fcon.add( file_dir + suffix, new_context, '', 's0', '') trans.finish() selinux.restorecon(file_dir, True, True, True) if __name__ == "__main__": update_context(sys.argv[1], sys.argv[2]) run the script with: [root@pki1 pki]# python3 update_context.py $PWD/test pki_tomcat_etc_rw_t Relabeled /etc/pki/test from unconfined_u:object_r:cert_t:s0 to system_u:object_r:cert_t:s0 Relabeled /etc/pki/test/alias from unconfined_u:object_r:cert_t:s0 to system_u:object_r:cert_t:s0 Updated digest for: /etc/pki/test *no* further _formatting_ is done here The context is replaced with the same old value. Expected results Running the same steps in Fedora41 the final step is: [root@vm-10-0-185-55 pki]# python update_context.py $PWD/test pki_tomcat_etc_rw_t Relabeled /etc/pki/test from unconfined_u:object_r:cert_t:s0 to system_u:object_r:pki_tomcat_etc_rw_t:s0 Relabeled /etc/pki/test/alias from unconfined_u:object_r:cert_t:s0 to system_u:object_r:pki_tomcat_etc_rw_t:s0 The context is properly configured. Actual results The context is not updated properly. Addtionally, if the resorecon CLI is executed after the script the context is properly updated: [root@pki1 pki]# ls -lZr test total 0 -rw-r--r--. 1 root root system_u:object_r:cert_t:s0 0 Jan 9 05:31 alias [root@pki1 pki]# restorecon -Rv test Relabeled /etc/pki/test from system_u:object_r:cert_t:s0 to system_u:object_r:pki_tomcat_etc_rw_t:s0 Relabeled /etc/pki/test/alias from system_u:object_r:cert_t:s0 to system_u:object_r:pki_tomcat_etc_rw_t:s0

Release Notes

No. of Comments

Resolution

Done-Errata