tmp files causing issues with selinux

[Rehan Khan]

Storing the rpm %pre and %post scripts in /tmp causes issues with systems secured by selinux. For example on Fedora useradd and groupadd are specifically constrained from being run from scripts in /tmp (selinux- targeted policy) so any rpm script which wants to add a user or group will *silently* fail. The only way to see the failure is in setroubleshooter.

Is there a better way/place to process rpm's? If this is an rpm problem how can smart handle this?

[Rehan Khan (rasker)]

I'm setting this to critical as it makes smart generally unusable on selinux constrained rpm based systems (Fedora 8/9).

[netmask (netmask)]

This is not really an Smart's issue, but a specific selinux config issue instead.

What happens in that all RPM transactions run as a child process of the "/usr/bin/smart". Since Smart is not natively shipped by Fedora, the context is not correctly marked. Check this:

# ls -lZ /usr/bin/yum
-rwxr-xr-x root root system_u:object_r:rpm_exec_t:s0 /usr/bin/yum

# ls -lZ /usr/bin/smart
-rwxr-xr-x root root ? /usr/bin/smart

# chcon system_u:object_r:rpm_exec_t:s0 /usr/bin/smart

# ls -lZ /usr/bin/smart
-rwxr-xr-x root root system_u:object_r:rpm_exec_t:s0 /usr/bin/smart

This is all about context: Smart calls RPM libs, so as Yum. RPM works fine under for Yum under Fedora, because it has the correct context set, so all you need to do is make Smart enter the same context.

In order to confirm, please, run the chcon command above, and try again.