-
Notifications
You must be signed in to change notification settings - Fork 3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Regex mismatch error being reported since rebase to fedora 35 [BUG] #225
Comments
I reported this at fedora discussions - https://discussion.fedoraproject.org/t/possible-security-issue-error-since-upgrade-regex-error-with-su-and-other-progs/34545/5 - and someone left a comment regarding a patch to SELinux that he found, in which the message is mentioned. |
I was able to fix the issue by issuing the following command to rebuild the SELinux policy:
|
Rebuilding the policy locally currently has issues, so I wouldn't recommend it. It's likely that the issues you were hitting were due in the first place to having local policy modifications. See coreos/fedora-coreos-tracker#701, and in particular follow the instructions starting at "For now if you are trying to figure out if your system will no longer receive policy updates". |
Ok, thanks, I have made no customizations myself, so I am wondering if its an exploit of some kind. I ran the command that is recoommended at the ....if your system will no longer... etc, config-diff |grep selinux etc, and nothing is displayed, which I wonder if is due to me having run
There are other differences reported as well, which is normal, I guess. On the fedora discussion question that I opened re: this issue someone reported the same thing, that there must be local policy differences, but I have made no changes personally. |
What are the modifications? E.g. what's in |
The big one you wan to look out for is the binary policy, e.g. |
I tried examining the policy.33 but it is a binary file (I guess that's what is meant by binary policy), so I can't list contents. Is there a way to diff it or view it? |
output of lsblk -fs doesn't show that device uuid. Could it be one of my vms? |
Hmm, not sure where that comes from. Seems like something automatically added it after a removable drive was plugged in? Anyway, again it doesn't hurt if those |
Ok, thanks. I ran the rsync command and it emptied the files. I then ran Cheers |
This issue tracker is intended only for Silverblue specific issues. We would like to ask you to try to reproduce the issue on a relevant Fedora Workstation release. If you will be able to reproduce there, then please report it in Red Hat Bugzilla or in upstream (preferred for GNOME projects) and not in this issue tracker.
Describe the bug
Today I used the su command to su from a standard account into the superuser account and I got the following error reported on the commandline immediately after the command and before the prompt....
The error occurs everytime I use the su command. I checked journalctl, and the error has been occurring across a wide range of programs/usecases since the rebase to 35.
errors:
To Reproduce
Please describe the steps needed to reproduce the bug:
Expected behavior
I expected no error, and am concerned that this is a security vulnerability. The machine I am using is running silverblue in a vm on gnome boxes, in which I am developing using podman to provision django, with a variety of containers including redis and elasticsearch, so I may have a broader surface attack area than other machines, and so perhaps htis is a security vulnerability. Also, I haven't seen the issue reported elsewhere.
Screenshots
If applicable, add screenshots to help explain your problem.
OS version:
Additional context
the vm silverblue is an updated to 35 version, and there is no regex mismatch being reported.
The text was updated successfully, but these errors were encountered: