Package: selinux-policy-default
X-Debbugs-Cc: bl...@volian.org
Version: 2:2.20240202-1
Severity: important
Hello,
I have been messing around with configuring Debian with CIS controls and using
SELinux.
The first problem I've encountered is that having `/var` configured with
`nosuid` option causes dpkg to break for scripts. An example of the error
message with `apt install vim`.
```
dpkg (subprocess): unable to execute new vim-runtime package pre-installation
script (/var/lib/dpkg/tmp.ci/preinst): Permission denied
dpkg: error processing archive
/var/cache/apt/archives/vim-runtime_2%3a9.1.0199-1_all.deb (--unpack):
new vim-runtime package pre-installation script subprocess returned error exit
status 2
dpkg (subprocess): unable to execute new vim-runtime package post-removal
script (/var/lib/dpkg/tmp.ci/postrm): Permission denied
dpkg: error while cleaning up:
new vim-runtime package post-removal script subprocess returned error exit
status 2
```
`audit2why -a` gives me
```
type=AVC msg=audit(1712517197.064:359): avc: denied { nosuid_transition } for
pid=5633 comm="dpkg" scontext=unconfined_u:unconfined_r:dpkg_t:s0-s0:c0.c1023
tcontext=unconfined_u:unconfined_r:dpkg_script_t
:s0-s0:c0.c1023 tclass=process2 permissive=0
```
and then `audit2why -a` gives me
```
#============= dpkg_t ==============
allow dpkg_t dpkg_script_t:process2 nosuid_transition;
```
I think due to the importance of dpkg in the Debian ecosystem this should
probably be allowed in the global policy.
Also it seems that the salsa repository for refpolicy is not up-to-date with
the package that is being distributed. Salsa still shows refpolicy 2022, but
I'm seeing 2024 installed on my system. If this could be resolved I'd like to
fork the repo and tinker with the policy.
Thanks,
Blake
-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.7.9-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not
set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: SELinux: enabled - Mode: Permissive - Policy name: default
Versions of packages selinux-policy-default depends on:
ii libselinux1 3.5-2+b1
ii libsemanage2 3.5-1+b3
ii libsepol2 3.5-2
ii policycoreutils 3.5-2
ii selinux-utils 3.5-2+b1
Versions of packages selinux-policy-default recommends:
ii checkpolicy 3.5-1
pn setools <none>
Versions of packages selinux-policy-default suggests:
pn logcheck <none>
pn syslog-summary <none>
-- no debconf information
