SELinux: running semodule -DB fails with "file_contexts: line X is missing fields, skipping"

[margamanterola]

Description

When trying to run semodule -DB before enabling enforcing mode in SELinux, a lot of errors like the following are printed:

/etc/selinux/mcs/contexts/files/file_contexts:  line 1 is missing fields, skipping
(...)
/etc/selinux/mcs/contexts/files/file_contexts:  line 1466 is missing fields, skipping
/etc/selinux/mcs/contexts/files/file_contexts.homedirs:  line 13 is missing fields, skipping
(...)
/etc/selinux/mcs/contexts/files/file_contexts.homedirs:  line 37 is missing fields, skipping

Impact

I'm not sure. I don't know if this means SELinux is using no contexts or if it's using some default contexts. Needs further investigation.

Environment and steps to reproduce

1. Set-up: a Flatcar Container Linux machine, with the latest stable release (2605.10.0)
2. Task: Trying to rebuild the SELinux module policy
3. Action(s): First, the relevant selinux directories in /etc and /var need to me made writable:

sudo rm /var/lib/selinux;
sudo cp -a /usr/lib/selinux/policy /var/lib/selinux
sudo rm /etc/selinux/mcs
sudo cp -a /usr/lib/selinux/mcs /etc/selinux

4. Error: [describe the error that was triggered]

Running semodule -DB will fail with the above mentioned errors.

Additional information

The mentioned files are generated by the command itself in a step before trying to parse them. I tried modifying the files manually to see what happened, and my changes got overwritten by the semodule command (this part is working as intended, as far as I understand, the actual contents come from /lib which is in the read-only file system).

Apparently, the contents generated by the command in one step are not parsed correctly in the following step.

This is where the error is generated, if there aren't two fields when reading the files:
https://github.com/SELinuxProject/selinux/blob/master/libselinux/src/label_media.c#L50

[margamanterola]

I tried with 2605.8.0 and with 2512.4.0 and got the same errors, so this is not a recent regression.

[agiterman1]

still not working on 2905.2.4
sample output:

/etc/selinux/mcs/contexts/files/file_contexts: line 1 is missing fields, skipping
/etc/selinux/mcs/contexts/files/file_contexts: line 2 is missing fields, skipping
/etc/selinux/mcs/contexts/files/file_contexts: line 3 is missing fields, skipping

[tormath1]

Hi @agiterman1 ; SELinux upgrade did not land yet on stable, it should be available middle of Oct. after the next stable release maintenance - it's in beta and alpha if you want to give a try.