Problem relabeling journalfile

Problem relabeling journalfile

[Dale Amon]

I've upgraded an ext2 to an ext3 file and while make relabeling
I get an error message:

/usr/sbin/setfiles: unable to relabel /.journal to system_u:object_r:file_t

suggestions?




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Problem relabeling journalfile

[Stephen Smalley]

On Mon, 2003-09-15 at 10:50, Dale Amon wrote:
> I've upgraded an ext2 to an ext3 file and while make relabeling
> I get an error message:
> 
> /usr/sbin/setfiles: unable to relabel /.journal to system_u:object_r:file_t
> 
> suggestions?

Add an entry for it to your file_contexts configuration with the special
notation "<<none>>" in place of the security context.  This tells
setfiles to ignore it.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Problem relabeling journalfile

[Dale Amon]

On Mon, Sep 15, 2003 at 10:53:36AM -0400, Stephen Smalley wrote:
> Add an entry for it to your file_contexts configuration with the special
> notation "<<none>>" in place of the security context.  This tells
> setfiles to ignore it.

Sorted. Thanks.

This might be a reasonable thing to add to standard the file_contexts:

#
# Journal files
/.journal	<<none>>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Problem relabeling journalfile

[Stephen Smalley]

On Mon, 2003-09-15 at 11:29, Dale Amon wrote:
> This might be a reasonable thing to add to standard the file_contexts:
> 
> #
> # Journal files
> /.journal	<<none>>

Patch below.  Note that you should escape dot since it will otherwise be
interpreted as "any character" by the regular expression matching code,
and we should include entries for common filesystem mount points to
cover most cases, similar to the existing entries for lost+found.  We
can likely drop out the persistent label mapping entries entirely aside
from backward compatibility support for the old SELinux.

Index: policy/file_contexts/types.fc
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/policy/file_contexts/types.fc,v
retrieving revision 1.7
diff -u -r1.7 types.fc
--- policy/file_contexts/types.fc	10 Jul 2003 14:45:07 -0000	1.7
+++ policy/file_contexts/types.fc	15 Sep 2003 15:39:07 -0000
@@ -346,6 +346,17 @@
 /usr/local/\.\.\.security(/.*)?	system_u:object_r:file_labels_t
 
 #
+# Journal files
+#
+/\.journal			<<none>>
+/usr/\.journal			<<none>>
+/boot/\.journal			<<none>>
+/home/\.journal			<<none>>
+/var/\.journal			<<none>>
+/tmp/\.journal			<<none>>
+/usr/local/\.journal		<<none>>
+
+#
 # Lost and found directories.
 #
 /lost\+found(/.*)?		system_u:object_r:lost_found_t



-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Problem relabeling journalfile

[Russell Coker]

On Tue, 16 Sep 2003 01:43, Stephen Smalley wrote:
> Patch below.  Note that you should escape dot since it will otherwise be
> interpreted as "any character" by the regular expression matching code,
> and we should include entries for common filesystem mount points to
> cover most cases, similar to the existing entries for lost+found.  We
> can likely drop out the persistent label mapping entries entirely aside
> from backward compatibility support for the old SELinux.

Do you think it would be beneficial to have a method of specifying rules that 
apply relative to the root of a file system instead of to the root?

EG:
FS/.journal
FS/lost\+found
FS/quota.user
FS/quota.group

With the current operation of setfiles for completeness we have to add such 
entries for every new mount point.  Having setfiles accept such a spec when 
labeling an entire file system would be easy to code, and it wouldn't be 
really difficult to manage the case of "setfiles -s".

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Problem relabeling journalfile

[Stephen Smalley]

On Mon, 2003-09-15 at 12:51, Russell Coker wrote:
> Do you think it would be beneficial to have a method of specifying rules that 
> apply relative to the root of a file system instead of to the root?
> 
> EG:
> FS/.journal
> FS/lost\+found
> FS/quota.user
> FS/quota.group
> 
> With the current operation of setfiles for completeness we have to add such 
> entries for every new mount point.  Having setfiles accept such a spec when 
> labeling an entire file system would be easy to code, and it wouldn't be 
> really difficult to manage the case of "setfiles -s".

You might be able to leverage the altroot support contributed by the
Hardened Gentoo developers to achieve the same effect without altering
the specification itself.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Problem relabeling journalfile

[Colin Walters]

On Mon, 2003-09-15 at 11:29, Dale Amon wrote:
> On Mon, Sep 15, 2003 at 10:53:36AM -0400, Stephen Smalley wrote:
> > Add an entry for it to your file_contexts configuration with the special
> > notation "<<none>>" in place of the security context.  This tells
> > setfiles to ignore it.
> 
> Sorted. Thanks.
> 
> This might be a reasonable thing to add to standard the file_contexts:
> 
> #
> # Journal files
> /.journal	<<none>>

I ran into this same issue a while back, and someone (I forget who now)
gave me the tip that if you boot from a different medium and run
'tune2fs /dev/hdX' with a recent enough tune2fs, it will automatically
hide the .journal inode.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.