From: Jason Zaman <jason@perfinion.com>
To: Mark Steele <mark@control-alt-del.org>
Cc: selinux@tycho.nsa.gov
Subject: Re: SELinux file context matching
Date: Wed, 3 Feb 2016 02:26:35 +0800 [thread overview]
Message-ID: <20160202182635.GA29269@meriadoc> (raw)
In-Reply-To: <56B0F257.60504@tycho.nsa.gov>
On Tue, Feb 02, 2016 at 01:15:51PM -0500, Stephen Smalley wrote:
> On 02/02/2016 12:48 PM, Mark Steele wrote:
> > Hi list,
> >
> > I've got some file contexts setup for an application, and can't get the
> > file context matching to work as I would expect.
> >
> > [root@dev1 policy]# cat
> > /etc/selinux/targeted/contexts/files/file_contexts | grep cinched
> > /etc/cinched(/.*)? system_u:object_r:ts_etc_t:s0
> > /var/log/cinched(/.*)? system_u:object_r:ts_log_t:s0
> > /var/lib/cinched(/.*)? system_u:object_r:ts_t:s0
> > */usr/lib64/cinched(/.*)? system_u:object_r:ts_lib_t:s0*
> > /etc/bash_completion.d/cinched_bash_completions
> > system_u:object_r:ts_etc_t:s0
> > /var/log/cinched/audit(/.*)? system_u:object_r:ts_audit_log_t:s0
> > /usr/sbin/cinched system_u:object_r:ts_exec_t:s0
> >
> > [root@dev1 policy]# matchpathcon /usr/lib64/cinched/
> > */usr/lib64/cinched system_u:object_r:lib_t:s0*
> >
> > [root@dev1 policy]# findcon
> > /etc/selinux/targeted/contexts/files/file_contexts -p /usr/lib64/cinched
> > /.* system_u:object_r:default_t:s0
> > /usr/.* system_u:object_r:usr_t:s0
> > */usr/lib64/cinched(/.*)? system_u:object_r:ts_lib_t:s0*
> >
> >
> > This is running on CentOS 7. I was assuming that since my rule has the
> > longest stem, it would be applied.
> >
> > Any suggestions?
>
> It would help to see the complete file_contexts file.
> Do you have anything in file_contexts.local that could be overriding it?
Also, file_contexts.subs*. /usr/lib64 and 32 are usually aliased to
/usr/lib so your fcontexts needs to be /usr/lib/cinched(/.*)? instead of
with the 64.
next prev parent reply other threads:[~2016-02-02 18:26 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-02 17:48 SELinux file context matching Mark Steele
2016-02-02 18:15 ` Stephen Smalley
2016-02-02 18:26 ` Jason Zaman [this message]
2016-02-02 18:31 ` Mike Palmiotto
2016-02-02 20:45 ` Mark Steele
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160202182635.GA29269@meriadoc \
--to=jason@perfinion.com \
--cc=mark@control-alt-del.org \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.