Re: Symlinks with wrong context after copy

[Thorsten Kukuk <kukuk@suse.de>]

On Fri, Oct 17, Stephen Smalley wrote:

> On Fri, 2003-10-17 at 09:32, Thorsten Kukuk wrote:
> > Hi,
> > 
> > I don't know if this is a libattr or a selinux bug:
> > 
> > Symlinks have wrong attributes after copying:
> > 
> > dilbert:~ # ls --context /lib/ld-*
> > -rwxr-xr-x  root     root     system_u:object_r:ld_so_t        /lib/ld-2.3.2.so
> > lrwxrwxrwx  root     root     system_u:object_r:ld_so_t        /lib/ld-linux.so.2 -> ld-2.3.2.so
> > 
> > dilbert:~ # cp -dp /lib/ld-* .
> > dilbert:~ # ls --context ld-*
> > -rwxr-xr-x  root     root     system_u:object_r:ld_so_t        ld-2.3.2.so
> > lrwxrwxrwx  root     root     system_u:object_r:sysadm_home_dir_t ld-linux.so.2 -> ld-2.3.2.so
> > 
> > any ideas what goes wrong?
> 
> The implication is that the attributes on the copied symlink weren't
> explicitly set, so they were instead left with the default (inheriting
> from the parent directory, unless otherwise configured by policy).

Yes, and the problem is, that somebody follows symlinks instead of
using the attributes of the symlinks itself. 

> Are you using the SELinux coreutils patch or the EA coreutils patch?  

I tried the SELinux coreutils patch on our own coreutils and the
RH binaries.

> Also, IIRC, there was a specific decision in the SELinux coreutils patch
> to not include the SELinux attributes as part of -p; you have to
> explicitly specify -c or --preserve=all or --preserve=context. 
> Otherwise, a number of programs that use -p will break because they
> aren't authorized to preserve the MAC security label.

But this doesn't matter: the binary itself is copied correct with
SElinux attributes, the symlink is not.

  Thorsten

-- 
Thorsten Kukuk       http://www.suse.de/~kukuk/        kukuk@suse.de
SuSE Linux AG        Deutschherrnstr. 15-19        D-90429 Nuernberg
--------------------------------------------------------------------    
Key fingerprint = A368 676B 5E1B 3E46 CFCE  2D97 F8FD 4E23 56C6 FB4B

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.