Re: New to SELinux -- any suggestions?

[Russell Coker <russell@coker.com.au>]

On Sunday 29 October 2006 12:41, Michael Graffam <michael.graffam@gmail.com> 
wrote:
> chcon -t uncontained_execmem_exec_t /usr/bin/sbcl
> (and /usr/local/bin/lisp)

Incidentally why are you running it from /usr/local/bin?  Why don't you use an 
RPM package of it?  If there is no RPM available have you considered building 
your own and submitting it to Extras?

> After fixing my problem, I wanted to demonstrate the behavior to a
> friend of mine, and found that I didn't have the foggiest idea of how to
> actually use chcon :) .. I couldn't remove the indicated permission from
> my bins.

The problem here is your idea of "removing the permission".  Chcon does not 
add or remove permissions, it merely changes the labels of files.  What the 
label means is determined by the policy.

So if you want to change a file back to it's default context you can 
use "restorecon", in this case "restorecon -F -R -v /usr/local /usr/bin" 
should do what you want.

Another option is to know what the original context was (maybe by examining 
the file with "ls -Z" before changing it in the first place).  In this case I 
know that the bin directories have type bin_t, so the following would work:
chcon -t bin_t /usr/bin/sbcl /usr/local/bin/lisp

-- 
russell@coker.com.au
http://etbe.blogspot.com/          My Blog

http://www.coker.com.au/sponsorship.html Sponsoring Free Software development

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.