Re: refpolicy HEAD, Debian, patch for udev.te

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Fri, 2007-11-30 at 16:30 +0100, Václav Ovsík wrote:
> On Fri, Nov 30, 2007 at 09:38:33AM -0500, Christopher J. PeBenito wrote:
> > ...
> > I thought that was the case, I was just surprised that it wasn't
> > short-circuited.  What is odd is that it makes the check for equality,
> > but then does the setfilecon anyway:
> 
> Udev startup script /etc/init.d/udev does on several places restorecon
> and /sbin/restorecon -R /dev before starting udevd. Symlinks
> already have right context so.
> If there will be for some reason no symlink, udevd should probably
> create one and relabel it. Right?

I thought thats what it did.

> > > Corresponding code is in udev_node.c, function node_symlink().
> > 
> > >     if (strcmp(target, buf) == 0) {
> > > 	    info("preserve already existing symlink '%s' to '%s'", slink,
> > > target);
> > > 	    selinux_setfilecon(slink, NULL, S_IFLNK);
> > > 	    goto exit;
> > >     }
> > 
> > I'll add the rule.  Perhaps someone should send up a patch to remove the
> > setfilecon, and update the info message.
> 
> Mean you to compare the context of symlink and no setfilecon if it is
> ok?

Yes.  Unless there's a good reason to keep it as-is that I don't know
about.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.