Re: A couple of patches to setfiles.

[Daniel J Walsh <dwalsh@redhat.com>]

Stephen Smalley wrote:

>On Tue, 2004-10-05 at 14:24, Stephen Smalley wrote:
>  
>
>>You want to log always?  Should be based on an option, like the existing
>>verbose option, and you likely only want to log if !only_changed_user as
>>with the verbose case.
>>    
>>
>
>Actually, there is already a -o option to log to a specified file.  Why
>add syslog calls as well?
>
>  
>
Steve Grub has pointed out that the way we are doing setfiles is all 
wrong, and that we should be logging
to syslog.  That way a management infrastructure could monitor and 
manage the environment.  Writing
temporary or log files in arbitrary places is wrong.  Tools like 
logrotate are going to clean them up.  ETC.
So the -o flag should go and we should use syslog.

So I think we need to relook at setfiles/fixfiles and plug them better 
into standard architecture. 

I think we need a mechanism to tell us when a file actually has the 
wrong context versus one that just does not
match the context in the file_context file.  Russell pointed out that 
the contents of the homedirectory should
not have an automatic tool looking at their context because it might 
open up a security hole if you were to
arbitrarily clean up the false positives.

Dan

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.