Symlinks with wrong context after copy

Symlinks with wrong context after copy

[Thorsten Kukuk]

Hi,

I don't know if this is a libattr or a selinux bug:

Symlinks have wrong attributes after copying:

dilbert:~ # ls --context /lib/ld-*
-rwxr-xr-x  root     root     system_u:object_r:ld_so_t        /lib/ld-2.3.2.so
lrwxrwxrwx  root     root     system_u:object_r:ld_so_t        /lib/ld-linux.so.2 -> ld-2.3.2.so

dilbert:~ # cp -dp /lib/ld-* .
dilbert:~ # ls --context ld-*
-rwxr-xr-x  root     root     system_u:object_r:ld_so_t        ld-2.3.2.so
lrwxrwxrwx  root     root     system_u:object_r:sysadm_home_dir_t ld-linux.so.2 -> ld-2.3.2.so

any ideas what goes wrong?

  Thorsten

-- 
Thorsten Kukuk       http://www.suse.de/~kukuk/        kukuk@suse.de
SuSE Linux AG        Deutschherrnstr. 15-19        D-90429 Nuernberg
--------------------------------------------------------------------    
Key fingerprint = A368 676B 5E1B 3E46 CFCE  2D97 F8FD 4E23 56C6 FB4B

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Symlinks with wrong context after copy

[Stephen Smalley]

On Fri, 2003-10-17 at 09:32, Thorsten Kukuk wrote:
> Hi,
> 
> I don't know if this is a libattr or a selinux bug:
> 
> Symlinks have wrong attributes after copying:
> 
> dilbert:~ # ls --context /lib/ld-*
> -rwxr-xr-x  root     root     system_u:object_r:ld_so_t        /lib/ld-2.3.2.so
> lrwxrwxrwx  root     root     system_u:object_r:ld_so_t        /lib/ld-linux.so.2 -> ld-2.3.2.so
> 
> dilbert:~ # cp -dp /lib/ld-* .
> dilbert:~ # ls --context ld-*
> -rwxr-xr-x  root     root     system_u:object_r:ld_so_t        ld-2.3.2.so
> lrwxrwxrwx  root     root     system_u:object_r:sysadm_home_dir_t ld-linux.so.2 -> ld-2.3.2.so
> 
> any ideas what goes wrong?

The implication is that the attributes on the copied symlink weren't
explicitly set, so they were instead left with the default (inheriting
from the parent directory, unless otherwise configured by policy).
Are you using the SELinux coreutils patch or the EA coreutils patch?  
Also, IIRC, there was a specific decision in the SELinux coreutils patch
to not include the SELinux attributes as part of -p; you have to
explicitly specify -c or --preserve=all or --preserve=context. 
Otherwise, a number of programs that use -p will break because they
aren't authorized to preserve the MAC security label.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Symlinks with wrong context after copy

[Thorsten Kukuk]

On Fri, Oct 17, Stephen Smalley wrote:

> On Fri, 2003-10-17 at 09:32, Thorsten Kukuk wrote:
> > Hi,
> > 
> > I don't know if this is a libattr or a selinux bug:
> > 
> > Symlinks have wrong attributes after copying:
> > 
> > dilbert:~ # ls --context /lib/ld-*
> > -rwxr-xr-x  root     root     system_u:object_r:ld_so_t        /lib/ld-2.3.2.so
> > lrwxrwxrwx  root     root     system_u:object_r:ld_so_t        /lib/ld-linux.so.2 -> ld-2.3.2.so
> > 
> > dilbert:~ # cp -dp /lib/ld-* .
> > dilbert:~ # ls --context ld-*
> > -rwxr-xr-x  root     root     system_u:object_r:ld_so_t        ld-2.3.2.so
> > lrwxrwxrwx  root     root     system_u:object_r:sysadm_home_dir_t ld-linux.so.2 -> ld-2.3.2.so
> > 
> > any ideas what goes wrong?
> 
> The implication is that the attributes on the copied symlink weren't
> explicitly set, so they were instead left with the default (inheriting
> from the parent directory, unless otherwise configured by policy).

Yes, and the problem is, that somebody follows symlinks instead of
using the attributes of the symlinks itself. 

> Are you using the SELinux coreutils patch or the EA coreutils patch?  

I tried the SELinux coreutils patch on our own coreutils and the
RH binaries.

> Also, IIRC, there was a specific decision in the SELinux coreutils patch
> to not include the SELinux attributes as part of -p; you have to
> explicitly specify -c or --preserve=all or --preserve=context. 
> Otherwise, a number of programs that use -p will break because they
> aren't authorized to preserve the MAC security label.

But this doesn't matter: the binary itself is copied correct with
SElinux attributes, the symlink is not.

  Thorsten

-- 
Thorsten Kukuk       http://www.suse.de/~kukuk/        kukuk@suse.de
SuSE Linux AG        Deutschherrnstr. 15-19        D-90429 Nuernberg
--------------------------------------------------------------------    
Key fingerprint = A368 676B 5E1B 3E46 CFCE  2D97 F8FD 4E23 56C6 FB4B

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Symlinks with wrong context after copy

[Stephen Smalley]

On Fri, 2003-10-17 at 10:17, Thorsten Kukuk wrote:
> I tried the SELinux coreutils patch on our own coreutils and the
> RH binaries.

# rpm -q coreutils
coreutils-5.0-27.sel
# ls -Z /lib/ld*
-rwxr-xr-x  root     root     system_u:object_r:ld_so_t        /lib/ld-2.3.2.so
lrwxrwxrwx  root     root     system_u:object_r:lib_t          /lib/ld-linux.so.2 -> ld-2.3.2.so
# cp -dp /lib/ld* .
# ls -Z ld*
-rwxr-xr-x  root     root     sds:object_r:sysadm_home_dir_t   ld-2.3.2.so
lrwxr-xr-x  root     root     sds:object_r:sysadm_home_dir_t   ld-linux.so.2 ->
ld-2.3.2.so
# rm -f ld*
# cp -dpc /lib/ld* .
# ls -Z ld*
-rwxr-xr-x  root     root     system_u:object_r:ld_so_t        ld-2.3.2.so
lrwxr-xr-x  root     root     system_u:object_r:lib_t          ld-linux.so.2 ->
ld-2.3.2.so

Things to note:
1) I changed the type on the symlink via chcon -h before starting so
that we can clearly see whether the context is being preserved from the
symlink itself or if the symlink is being followed.
2) cp -dp does not preserve the security context on either file, as
expected; instead, the files end up in the default type, inheriting from
the parent directory.  Note that the EA-patched coreutils might give a
different behavior; I don't know myself.
3) cp -dpc preserves the context on both files, as expected.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.