EL10 SELinux packages ship policydb v23 modules that RHEL 10.0 cannot load

[TinajaLabs]

Summary

On RHEL 10.0, the EL10 packages icinga2-selinux and icingaweb2-selinux install successfully, but their SELinux policy modules do not load.

Both packages ship compiled .pp modules that fail with:

libsepol.policydb_read: policydb module version 23 does not match my version range 4-22

As a result, the packages appear installed, but the SELinux modules are not present in semodule -l, file contexts are not active, and Icinga services are not confined by the expected Icinga SELinux domains.

Environment

Platform: Red Hat Enterprise Linux 10.0 (Coughlan)
Kernel: 6.12.0-55.9.1.el10_0.x86_64
Architecture: x86_64
SELinux mode: enforcing
Loaded policy: targeted

Icinga versions:

icinga2-2.16.0-1.el10.x86_64
icinga2-bin-2.16.0-1.el10.x86_64
icinga2-selinux-2.16.0-1.el10.x86_64
icingaweb2-selinux-2.13.0-1.el10.noarch
selinux-policy-targeted-40.13.26-1.el10.noarch

Icinga 2 version:

The Icinga 2 network monitoring daemon (version: r2.16.0-1)
OpenSSL version: OpenSSL 3.2.2 4 Jun 2024

SELinux status:

SELinux status:                 enabled
Loaded policy name:             targeted
Current mode:                   enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      33

What happens

The packages install without error:

dnf reinstall icinga2-selinux

But the module is not loaded:

sudo semodule -l | grep -i icinga || echo "Icinga SELinux module not loaded"

Output:

Icinga SELinux module not loaded

The Icinga daemon binary still resolves to a generic context:

matchpathcon /usr/lib64/icinga2/sbin/icinga2

Output:

/usr/lib64/icinga2/sbin/icinga2    system_u:object_r:lib_t:s0

The running process is unconfined:

ps -eZ | grep icinga2

Output:

system_u:system_r:unconfined_service_t:s0 ... icinga2
system_u:system_r:unconfined_service_t:s0 ... icinga2
system_u:system_r:unconfined_service_t:s0 ... icinga2

Manual semodule test: icinga2-selinux

sudo semodule -s targeted -i /usr/share/selinux/targeted/icinga2.pp

Output:

libsemanage.semanage_pipe_data: Child process /usr/libexec/selinux/hll/pp failed with code: 255. (No such file or directory).
libsemanage.semanage_compile_module: icinga2: libsepol.policydb_read: policydb module version 23 does not match my version range 4-22
. (No such file or directory).
libsemanage.semanage_compile_module: icinga2: libsepol.sepol_module_package_read: invalid module in module package (at section 0)
. (No such file or directory).
libsemanage.semanage_compile_module: icinga2: libsepol.sepol_ppfile_to_module_package: Failed to read policy package
. (No such file or directory).
libsemanage.semanage_direct_commit: Failed to compile hll files into cil files. (No such file or directory).
semodule:  Failed!

Manual semodule test: icingaweb2-selinux

icingaweb2-selinux exhibits the same failure pattern: a manual semodule -i /usr/share/selinux/targeted/icingaweb2.pp fails with the identical policydb module version 23 does not match my version range 4-22 error.

Installed policy files

icinga2-selinux includes:

/usr/share/selinux/mls/icinga2.pp
/usr/share/selinux/targeted/icinga2.pp
/usr/share/doc/icinga2-selinux/icinga2.fc
/usr/share/doc/icinga2-selinux/icinga2.if
/usr/share/doc/icinga2-selinux/icinga2.te

icingaweb2-selinux includes:

/usr/share/selinux/mls/icingaweb2.pp
/usr/share/selinux/targeted/icingaweb2.pp

Package scriptlet behavior

Both RPM postinstall scripts appear to suppress the semodule failure.
For icinga2-selinux:

/usr/sbin/semodule -s ${selinuxvariant} -i \
/usr/share/selinux/${selinuxvariant}/icinga2.pp &> /dev/null || :

For icingaweb2-selinux:

/usr/sbin/semodule -s ${selinuxvariant} -i /usr/share/selinux/${selinuxvariant}/icingaweb2.pp &> /dev/null || true

Because stderr is redirected to /dev/null and failures are ignored, dnf reports a successful install even though the SELinux modules are not loaded.

Current impact

Icinga is operational, but the Icinga SELinux policy is not active.

Current process contexts include:

system_u:system_r:unconfined_service_t:s0 ... icinga2
system_u:system_r:unconfined_service_t:s0 ... icingadb
system_u:system_r:unconfined_service_t:s0 ... icingadb-redis
system_u:system_r:httpd_t:s0 ... httpd
system_u:system_r:httpd_t:s0 ... php-fpm

Current Icinga Web paths resolve to generic contexts:

/usr/share/icingaweb2    system_u:object_r:usr_t:s0
/etc/icingaweb2          system_u:object_r:etc_t:s0
/var/log/icingaweb2      system_u:object_r:var_log_t:s0
/var/lib/icingaweb2      system_u:object_r:var_lib_t:s0

Expected behavior

On RHEL 10.0, installing icinga2-selinux and icingaweb2-selinux should either:

1. Load SELinux policy modules compatible with the RHEL 10.0 SELinux toolchain, or
2. Fail visibly during package installation if the supplied .pp files cannot be loaded.

Suspected cause

The EL10 RPMs appear to ship compiled SELinux .pp modules built with policydb module version 23, while this RHEL 10.0 system’s SELinux userspace accepts only policydb module versions 4-22.

Request

Please rebuild or repackage the EL10 SELinux policy modules so they are compatible with RHEL 10.0, or adjust the RPM packaging to build/load policy locally in a compatible format.

Also, please consider making the RPM scriptlets fail visibly or at least log the semodule error when policy installation fails, because the current behavior leaves the packages installed but non-functional.

Disclosure: assistance from chatgpt.

[Al2Klimov]

I've tried something, but please don't ask me for a release date:

https://git.icinga.com/packages/icinga2/-/merge_requests/21

[TinajaLabs]

OK. No bad fixes... Thanks. ;)

[Al2Klimov]

@lippserd Shall I just pin our base image to its .0 version?

[Al2Klimov]

https://git.icinga.com/packages/icinga2/-/merge_requests/21

For non-insiders, this WIP fix is about passing -c 22 to checkmodule, so that icinga2-selinux just work on all RHEL 10.x.

Shall I just pin our base image to its .0 version?

This, in contrast, has not fixed the symptoms described here, so neither will adding RHEL 10.0 and 10.1 repos, I'm afraid:

https://git.icinga.com/packages/tooling/ci-templates/-/merge_requests/154