problem relabel the file system

problem relabel the file system

[Ying-Hung Chen]

Hi All,

	I have installed SELinux on couple of my machines, it usually go
through ok at the first time, but when i try to relabel again for any
reason (i.e. change the policy/file_contexts) I always have some files
that refuse to get relabel again and cause make file to fail.

	I did remove ALL the .../security for all the partitions and did a make
initinstall in the policy (instruction 5 and 7 in the installation
guide) but no luck.

	I noticed on the installation guide, it mentioned:

"Although this invalidates any existing file labels, it does not clear
the persistent SID values in the inodes.  Consequently, some warnings
are likely when the file system is relabeled in step 12.  A program
will be provided in the future to clear the persistent SID values."

does this cause the make relabel to fail since inodes never get clean
up? are there any work arounds?

Thanks,

-Ying

--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: problem relabel the file system

[Stephen Smalley]

> 	I have installed SELinux on couple of my machines, it usually go
> through ok at the first time, but when i try to relabel again for any
> reason (i.e. change the policy/file_contexts) I always have some files
> that refuse to get relabel again and cause make file to fail.

What exactly is the error that you are seeing?  Are any kernel log
messages being generated by the failure (check the output of
'dmesg' immediately after trying to do a 'make relabel')?  If you
are using a SELinux kernel in enforcing mode, I would guess that
your problem is due to a lack of file transition permissions in the policy
configuration between the relevant types.  The example policy
configuration is only really set up for the initial relabeling.  
File relabeling is controlled by three permissions:
1) The domain must have relabelfrom permission to the old type, and
2) The old type must have transition permission to the new type, and
3) The domain must have relabelto permission to the new type.

For unrestricted type transitions, you could add this rule:
    allow file_type file_type:dir_file_class_set transition;

In this case, the system would no longer control type transitions
but would continue to control what domains can cause such
transitions.

> 	I did remove ALL the .../security for all the partitions and did a make
> initinstall in the policy (instruction 5 and 7 in the installation
> guide) but no luck.

You don't need to remove the old persistent label mappings if
you are simply changing policy/file_contexts.  Removing the old
mappings is only for upgrading to newer versions of SELinux, and
frequently isn't even necessary in that case.

> 	I noticed on the installation guide, it mentioned:
> 
> "Although this invalidates any existing file labels, it does not clear
> the persistent SID values in the inodes.  Consequently, some warnings
> are likely when the file system is relabeled in step 12.  A program
> will be provided in the future to clear the persistent SID values."
> 
> does this cause the make relabel to fail since inodes never get clean
> up? are there any work arounds?

Yes, this can cause a failure if you are running a SELinux kernel in
enforcing mode.  As I mentioned above, you should only do this
when upgrading to a newer version, and you should use a development
kernel in permissive mode to do the initial relabeling to avoid
failures.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com






--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.