* Re: Added is_context_configurable function
2005-01-12 14:19 ` Stephen Smalley
@ 2005-01-12 14:44 ` Daniel J Walsh
2005-01-12 15:37 ` Daniel J Walsh
` (3 subsequent siblings)
4 siblings, 0 replies; 25+ messages in thread
From: Daniel J Walsh @ 2005-01-12 14:44 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Colin Walters, SELinux
Stephen Smalley wrote:
>On Tue, 2005-01-11 at 17:10, Colin Walters wrote:
>
>
>>I've said this before, but I don't like the idea of having to edit
>>file_contexts whenever I want to change the labels. I feel that the
>>on-disk version should be canonical, and the file_contexts only used for
>>system initialization.
>>
>>
>
>That is also my view. However, if people are going to run setfiles or
>restorecon at runtime to check or set contexts (which is current
>practice in Fedora), then we do need a way to distinguish legitimate
>customizations from what are essentially bugs in the policy (e.g. lack
>of a file type transition rule) or applications (e.g. failure to
>preserve or set context on a file where file type transition rules are
>insufficient). The file contexts configuration seemed like a reasonable
>way to capture that distinction to me. Two questions:
>1) Is it sufficient to identify legitimate customizations based solely
>on the TE type of the file? If not, what other information should be
>taken into account, irrespective of whether this is done via
>file_contexts or via a different config file?
>
>
I think we can somewhat do that now. I am not looking at the ability to
put general
files in random location, just based off the wim of the Administrator.
IE putting
/var/named some where else is not what we are considering, in this case
a secondary
file_context.local file should be required. But the usual case of
labeling file for sharing
IE samba_share_t, http*, ftp_anon_t. These will be come common, and the
admin should not
be required to update file_context in this case. (We had considered
calling them sharables)
>2) Is it feasible for the policy writer to identify all such TE types a
>priori in the policy without covering such a large set as to make
>setfiles/restorecon completely useless by default? If not, what
>mechanism will be provided to allow users/admins to easily mark
>additional types without conflicting with future policy updates?
>
>
>
I believe so as long as we confine it to shareable types of context, not
files that have standard locations,
that an admin might decide to change.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread* Re: Added is_context_configurable function
2005-01-12 14:19 ` Stephen Smalley
2005-01-12 14:44 ` Daniel J Walsh
@ 2005-01-12 15:37 ` Daniel J Walsh
2005-01-20 15:29 ` Stephen Smalley
2005-01-12 15:39 ` Daniel J Walsh
` (2 subsequent siblings)
4 siblings, 1 reply; 25+ messages in thread
From: Daniel J Walsh @ 2005-01-12 15:37 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Colin Walters, SELinux
[-- Attachment #1: Type: text/plain, Size: 470 bytes --]
Patched for libselinux.
This patch changes the previous to rename configurable_contexts to
customizable_paths.
Also modifies matchpathcon to process file_contexts.local
So if a user wants to change the config file of a server to a different
location they can
do something like the following
sed 's|/var/www|/usr/local/www/g'
/etc/selinux/targeted/context/file_context >
/etc/selinux/targeted/context/file_context.local
And then restorecon -R -v /usr/local/www
[-- Attachment #2: libselinux-rhat.patch --]
[-- Type: text/x-patch, Size: 12781 bytes --]
diff --exclude-from=exclude -N -u -r nsalibselinux/include/selinux/selinux.h libselinux-1.20.1/include/selinux/selinux.h
--- nsalibselinux/include/selinux/selinux.h 2004-12-03 14:40:05.000000000 -0500
+++ libselinux-1.20.1/include/selinux/selinux.h 2005-01-12 10:09:49.691145916 -0500
@@ -226,6 +226,7 @@
extern const char *selinux_media_context_path(void);
extern const char *selinux_contexts_path(void);
extern const char *selinux_booleans_path(void);
+extern const char *selinux_customizable_types_path(void);
/* Check a permission in the passwd class.
Return 0 if granted or -1 otherwise. */
@@ -242,6 +243,10 @@
const char *filename,
char *const argv[], char *const envp[]);
+/* Returns whether a file context is customizable, and should not
+ be relabeled . */
+extern int is_context_customizable (security_context_t scontext);
+
#ifdef __cplusplus
}
#endif
diff --exclude-from=exclude -N -u -r nsalibselinux/man/man3/is_context_customizable.3 libselinux-1.20.1/man/man3/is_context_customizable.3
--- nsalibselinux/man/man3/is_context_customizable.3 1969-12-31 19:00:00.000000000 -0500
+++ libselinux-1.20.1/man/man3/is_context_customizable.3 2005-01-12 10:09:49.692145804 -0500
@@ -0,0 +1,22 @@
+.TH "is_context_customizable" "3" "10 January 2005" "dwalsh@redhat.com" "SELinux API documentation"
+.SH "NAME"
+is_context_customizable \- check whether context type is customizable by the administrator.
+.SH "SYNOPSIS"
+.B #include <selinux/selinux.h>
+.sp
+.B int is_context_customizable(security_context_t scon);
+
+.SH "DESCRIPTION"
+.B is_context_customizable
+.br
+This function checks whether the type of scon is in the /etc/selinux/SELINUXTYPE/context/customizable_types file. A customizable type is a file context type that
+administrators set on files, usually to allow certain domains to share the file content. restorecon and setfiles, by default, leave these context in place.
+
+
+.SH "RETURN VALUE"
+returns 1 if security context is customizable or 0 if it is not.
+returns -1 on error
+
+.SH "FILE"
+/etc/selinux/SELINUXTYPE/context/customizable_types
+
diff --exclude-from=exclude -N -u -r nsalibselinux/src/file_path_suffixes.h libselinux-1.20.1/src/file_path_suffixes.h
--- nsalibselinux/src/file_path_suffixes.h 2004-10-20 16:31:36.000000000 -0400
+++ libselinux-1.20.1/src/file_path_suffixes.h 2005-01-12 10:09:49.693145692 -0500
@@ -9,3 +9,4 @@
S_(BOOLEANS, "/booleans")
S_(MEDIA_CONTEXTS, "/contexts/files/media")
S_(REMOVABLE_CONTEXT, "/contexts/removable_context")
+S_(CUSTOMIZABLE_TYPES, "/contexts/customizable_types")
diff --exclude-from=exclude -N -u -r nsalibselinux/src/is_customizable_type.c libselinux-1.20.1/src/is_customizable_type.c
--- nsalibselinux/src/is_customizable_type.c 1969-12-31 19:00:00.000000000 -0500
+++ libselinux-1.20.1/src/is_customizable_type.c 2005-01-12 10:09:49.695145469 -0500
@@ -0,0 +1,68 @@
+#include <unistd.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <ctype.h>
+#include <pwd.h>
+#include <selinux/selinux.h>
+
+static int get_customizable_type_list (security_context_t **retlist)
+{
+ FILE *fp;
+ char buf[4097];
+ int ctr=0, i;
+ security_context_t *list=NULL;
+
+ fp = fopen(selinux_customizable_types_path(), "r");
+ if (!fp)
+ return -1;
+
+ while (fgets_unlocked(buf, 4096, fp)) {
+ ctr++;
+ }
+ rewind(fp);
+ if (ctr) {
+ list=(security_context_t *) calloc(sizeof(security_context_t *), ctr+1);
+ if (list) {
+ i=0;
+ while (fgets_unlocked(buf, 4096, fp)) {
+ buf[strlen(buf)-1]=0;
+ list[i++]=(security_context_t) strdup(buf);
+ if (i>ctr) {
+ /* Should never happen */
+ free(list);
+ list=NULL;
+ break;
+ }
+ }
+ }
+ }
+ fclose(fp);
+ if (!list)
+ return -1;
+ *retlist=list;
+ return 0;
+}
+
+static security_context_t *customizable_list=NULL;
+
+int is_context_customizable (security_context_t scontext) {
+ int i;
+ char *ptr;
+ if (! customizable_list) {
+ if (get_customizable_type_list(&customizable_list)!=0)
+ return -1;
+ }
+
+ ptr=strrchr(scontext, ':');
+ if (ptr) {
+ ptr++;
+ } else {
+ ptr=scontext;
+ }
+ for (i = 0; customizable_list[i]; i++) {
+ if (strcmp(customizable_list[i],ptr) == 0) return 1;
+ }
+ return 0;
+}
diff --exclude-from=exclude -N -u -r nsalibselinux/src/matchpathcon.c libselinux-1.20.1/src/matchpathcon.c
--- nsalibselinux/src/matchpathcon.c 2004-12-29 11:51:23.000000000 -0500
+++ libselinux-1.20.1/src/matchpathcon.c 2005-01-12 10:10:03.411611561 -0500
@@ -207,15 +207,135 @@
}
return;
}
-
+static int process_line( const char *path, char *line_buf, int pass, int lineno) {
+ int items, len, regerr;
+ char *buf_p;
+ char *regex, *type, *context;
+ char *anchored_regex;
+ len = strlen(line_buf);
+ if (line_buf[len - 1] != '\n') {
+ myprintf("%s: line %d is too long, would be truncated, skipping\n", path, lineno);
+ return 0;
+ }
+ line_buf[len - 1] = 0;
+ buf_p = line_buf;
+ while (isspace(*buf_p))
+ buf_p++;
+ /* Skip comment lines and empty lines. */
+ if (*buf_p == '#' || *buf_p == 0)
+ return 0;
+ items =
+ sscanf(line_buf, "%as %as %as", ®ex, &type,
+ &context);
+ if (items < 2) {
+ myprintf("%s: line %d is missing fields\n, skipping", path, lineno);
+ return 0;
+ } else if (items == 2) {
+ /* The type field is optional. */
+ free(context);
+ context = type;
+ type = 0;
+ }
+
+ if (pass == 1) {
+ /* On the second pass, compile and store the specification in spec. */
+ const char *reg_buf = regex;
+ char *cp;
+ spec_arr[nspec].stem_id = find_stem_from_spec(®_buf);
+ spec_arr[nspec].regex_str = regex;
+
+ /* Anchor the regular expression. */
+ len = strlen(reg_buf);
+ cp = anchored_regex = malloc(len + 3);
+ if (!anchored_regex)
+ return -1;
+ /* Create ^...$ regexp. */
+ *cp++ = '^';
+ cp = mempcpy(cp, reg_buf, len);
+ *cp++ = '$';
+ *cp = '\0';
+
+ /* Compile the regular expression. */
+ regerr =
+ regcomp(&spec_arr[nspec].regex,
+ anchored_regex,
+ REG_EXTENDED | REG_NOSUB);
+ free(anchored_regex);
+ if (regerr < 0) {
+ myprintf("%s: line %d has invalid regex %s\n", path, lineno, anchored_regex);
+ return 0;
+ }
+
+ /* Convert the type string to a mode format */
+ spec_arr[nspec].type_str = type;
+ spec_arr[nspec].mode = 0;
+ if (!type)
+ goto skip_type;
+ len = strlen(type);
+ if (type[0] != '-' || len != 2) {
+ myprintf("%s: line %d has invalid file type %s\n", path, lineno, type);
+ return 0;
+ }
+ switch (type[1]) {
+ case 'b':
+ spec_arr[nspec].mode = S_IFBLK;
+ break;
+ case 'c':
+ spec_arr[nspec].mode = S_IFCHR;
+ break;
+ case 'd':
+ spec_arr[nspec].mode = S_IFDIR;
+ break;
+ case 'p':
+ spec_arr[nspec].mode = S_IFIFO;
+ break;
+ case 'l':
+ spec_arr[nspec].mode = S_IFLNK;
+ break;
+ case 's':
+ spec_arr[nspec].mode = S_IFSOCK;
+ break;
+ case '-':
+ spec_arr[nspec].mode = S_IFREG;
+ break;
+ default:
+ myprintf("%s: line %d has invalid file type %s\n", path, lineno, type);
+ return 0;
+ }
+
+ skip_type:
+
+ spec_arr[nspec].context = context;
+
+ if (strcmp(context, "<<none>>")) {
+ if (security_check_context(context) < 0 && errno != ENOENT) {
+ myprintf("%s: line %d has invalid context %s\n", path, lineno, context);
+ return 0;
+ }
+ }
+
+ /* Determine if specification has
+ * any meta characters in the RE */
+ spec_hasMetaChars(&spec_arr[nspec]);
+ }
+
+ nspec++;
+ if (pass == 0) {
+ free(regex);
+ if (type)
+ free(type);
+ free(context);
+ }
+ return 0;
+}
static int matchpathcon_init(void)
{
FILE *fp;
const char *path;
- char line_buf[BUFSIZ + 1], *buf_p;
- char *regex, *type, *context;
- char *anchored_regex;
- int items, len, lineno, pass, regerr, i, j;
+ FILE *localfp;
+ char local_path[PATH_MAX + 1];
+ char line_buf[BUFSIZ + 1];
+ int lineno, pass, i, j;
spec_t *spec_copy;
/* Open the specification file. */
@@ -223,6 +343,9 @@
if ((fp = fopen(path, "r")) == NULL)
return -1;
+ snprintf(local_path, sizeof(local_path), "%s.local", path);
+ localfp = fopen(local_path, "r");
+
/*
* Perform two passes over the specification file.
* The first pass counts the number of specifications and
@@ -235,123 +358,15 @@
lineno = 0;
nspec = 0;
while (fgets_unlocked(line_buf, sizeof line_buf, fp)) {
- lineno++;
- len = strlen(line_buf);
- if (line_buf[len - 1] != '\n') {
- myprintf("%s: line %d is too long, would be truncated, skipping\n", path, lineno);
- continue;
- }
- line_buf[len - 1] = 0;
- buf_p = line_buf;
- while (isspace(*buf_p))
- buf_p++;
- /* Skip comment lines and empty lines. */
- if (*buf_p == '#' || *buf_p == 0)
- continue;
- items =
- sscanf(line_buf, "%as %as %as", ®ex, &type,
- &context);
- if (items < 2) {
- myprintf("%s: line %d is missing fields\n, skipping", path, lineno);
- continue;
- } else if (items == 2) {
- /* The type field is optional. */
- free(context);
- context = type;
- type = 0;
- }
-
- if (pass == 1) {
- /* On the second pass, compile and store the specification in spec. */
- const char *reg_buf = regex;
- char *cp;
- spec_arr[nspec].stem_id = find_stem_from_spec(®_buf);
- spec_arr[nspec].regex_str = regex;
-
- /* Anchor the regular expression. */
- len = strlen(reg_buf);
- cp = anchored_regex = malloc(len + 3);
- if (!anchored_regex)
+ if (process_line(path, line_buf, pass, ++lineno) != 0)
+ return -1;
+ }
+ if (localfp)
+ while (fgets_unlocked(line_buf, sizeof line_buf, localfp)) {
+ if (process_line(local_path, line_buf, pass, ++lineno) != 0)
return -1;
- /* Create ^...$ regexp. */
- *cp++ = '^';
- cp = mempcpy(cp, reg_buf, len);
- *cp++ = '$';
- *cp = '\0';
-
- /* Compile the regular expression. */
- regerr =
- regcomp(&spec_arr[nspec].regex,
- anchored_regex,
- REG_EXTENDED | REG_NOSUB);
- free(anchored_regex);
- if (regerr < 0) {
- myprintf("%s: line %d has invalid regex %s\n", path, lineno, anchored_regex);
- continue;
- }
-
- /* Convert the type string to a mode format */
- spec_arr[nspec].type_str = type;
- spec_arr[nspec].mode = 0;
- if (!type)
- goto skip_type;
- len = strlen(type);
- if (type[0] != '-' || len != 2) {
- myprintf("%s: line %d has invalid file type %s\n", path, lineno, type);
- continue;
- }
- switch (type[1]) {
- case 'b':
- spec_arr[nspec].mode = S_IFBLK;
- break;
- case 'c':
- spec_arr[nspec].mode = S_IFCHR;
- break;
- case 'd':
- spec_arr[nspec].mode = S_IFDIR;
- break;
- case 'p':
- spec_arr[nspec].mode = S_IFIFO;
- break;
- case 'l':
- spec_arr[nspec].mode = S_IFLNK;
- break;
- case 's':
- spec_arr[nspec].mode = S_IFSOCK;
- break;
- case '-':
- spec_arr[nspec].mode = S_IFREG;
- break;
- default:
- myprintf("%s: line %d has invalid file type %s\n", path, lineno, type);
- continue;
- }
-
- skip_type:
-
- spec_arr[nspec].context = context;
-
- if (strcmp(context, "<<none>>")) {
- if (security_check_context(context) < 0 && errno != ENOENT) {
- myprintf("%s: line %d has invalid context %s\n", path, lineno, context);
- continue;
- }
- }
-
- /* Determine if specification has
- * any meta characters in the RE */
- spec_hasMetaChars(&spec_arr[nspec]);
}
- nspec++;
- if (pass == 0) {
- free(regex);
- if (type)
- free(type);
- free(context);
- }
- }
-
if (pass == 0) {
if (nspec == 0)
return 0;
@@ -360,9 +375,11 @@
return -1;
memset(spec_arr, '\0', sizeof(spec_t) * nspec);
rewind(fp);
+ if (localfp) rewind(localfp);
}
}
fclose(fp);
+ if (localfp) fclose(localfp);
/* Move exact pathname specifications to the end. */
spec_copy = malloc(sizeof(spec_t) * nspec);
diff --exclude-from=exclude -N -u -r nsalibselinux/src/selinux_config.c libselinux-1.20.1/src/selinux_config.c
--- nsalibselinux/src/selinux_config.c 2004-10-20 16:31:36.000000000 -0400
+++ libselinux-1.20.1/src/selinux_config.c 2005-01-12 10:09:49.698145133 -0500
@@ -26,7 +26,8 @@
#define BOOLEANS 7
#define MEDIA_CONTEXTS 8
#define REMOVABLE_CONTEXT 9
-#define NEL 10
+#define CUSTOMIZABLE_TYPES 10
+#define NEL 11
/* New layout is relative to SELINUXDIR/policytype. */
static char *file_paths[NEL];
@@ -211,6 +212,10 @@
return get_path(MEDIA_CONTEXTS);
}
+const char *selinux_customizable_types_path() {
+ return get_path(CUSTOMIZABLE_TYPES);
+}
+
const char *selinux_contexts_path() {
return get_path(CONTEXTS_DIR);
}
^ permalink raw reply [flat|nested] 25+ messages in thread* Re: Added is_context_configurable function
2005-01-12 15:37 ` Daniel J Walsh
@ 2005-01-20 15:29 ` Stephen Smalley
0 siblings, 0 replies; 25+ messages in thread
From: Stephen Smalley @ 2005-01-20 15:29 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Colin Walters, SELinux
[-- Attachment #1: Type: text/plain, Size: 748 bytes --]
On Wed, 2005-01-12 at 10:37, Daniel J Walsh wrote:
> Patched for libselinux.
>
> This patch changes the previous to rename configurable_contexts to
> customizable_paths.
>
> Also modifies matchpathcon to process file_contexts.local
>
> So if a user wants to change the config file of a server to a different
> location they can
> do something like the following
>
> sed 's|/var/www|/usr/local/www/g'
> /etc/selinux/targeted/context/file_context >
> /etc/selinux/targeted/context/file_context.local
>
> And then restorecon -R -v /usr/local/www
Thanks, merged into sourceforge CVS as of libselinux version 1.21.1,
along with the modifications below relative to your patch.
--
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency
[-- Attachment #2: libselinux-fixes.patch --]
[-- Type: text/x-patch, Size: 3672 bytes --]
Index: libselinux/src/is_customizable_type.c
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/libselinux/src/is_customizable_type.c,v
retrieving revision 1.1
diff -u -p -r1.1 is_customizable_type.c
--- libselinux/src/is_customizable_type.c 19 Jan 2005 16:09:40 -0000 1.1
+++ libselinux/src/is_customizable_type.c 19 Jan 2005 16:25:03 -0000
@@ -5,36 +5,40 @@
#include <string.h>
#include <ctype.h>
#include <pwd.h>
-#include <selinux/selinux.h>
+#include <limits.h>
+#include "selinux_internal.h"
+#include "context_internal.h"
static int get_customizable_type_list (security_context_t **retlist)
{
FILE *fp;
char buf[4097];
- int ctr=0, i;
+ unsigned int ctr=0, i;
security_context_t *list=NULL;
fp = fopen(selinux_customizable_types_path(), "r");
if (!fp)
return -1;
- while (fgets_unlocked(buf, 4096, fp)) {
+ while (fgets_unlocked(buf, 4096, fp) && ctr < UINT_MAX) {
ctr++;
}
rewind(fp);
if (ctr) {
- list=(security_context_t *) calloc(sizeof(security_context_t *), ctr+1);
+ list=(security_context_t *) calloc(sizeof(security_context_t), ctr+1);
if (list) {
i=0;
- while (fgets_unlocked(buf, 4096, fp)) {
+ while (fgets_unlocked(buf, 4096, fp) && i < ctr) {
buf[strlen(buf)-1]=0;
- list[i++]=(security_context_t) strdup(buf);
- if (i>ctr) {
- /* Should never happen */
+ list[i]=(security_context_t) strdup(buf);
+ if (!list[i]) {
+ unsigned int j;
+ for (j = 0; j < i; j++) free(list[j]);
free(list);
list=NULL;
break;
}
+ i++;
}
}
}
@@ -49,20 +53,31 @@ static security_context_t *customizable_
int is_context_customizable (security_context_t scontext) {
int i;
- char *ptr;
+ const char *type;
+ context_t c;
+
if (! customizable_list) {
if (get_customizable_type_list(&customizable_list)!=0)
return -1;
}
-
- ptr=strrchr(scontext, ':');
- if (ptr) {
- ptr++;
- } else {
- ptr=scontext;
+
+ c = context_new(scontext);
+ if (!c)
+ return -1;
+
+ type = context_type_get(c);
+ if (!type) {
+ context_free(c);
+ return -1;
}
+
for (i = 0; customizable_list[i]; i++) {
- if (strcmp(customizable_list[i],ptr) == 0) return 1;
+ if (strcmp(customizable_list[i],type) == 0) {
+ context_free(c);
+ return 1;
+ }
}
+ context_free(c);
return 0;
}
+
Index: libselinux/src/selinux_config.c
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/libselinux/src/selinux_config.c,v
retrieving revision 1.11
diff -u -p -r1.11 selinux_config.c
--- libselinux/src/selinux_config.c 19 Jan 2005 16:09:40 -0000 1.11
+++ libselinux/src/selinux_config.c 19 Jan 2005 16:14:54 -0000
@@ -215,6 +215,7 @@ const char *selinux_media_context_path()
const char *selinux_customizable_types_path() {
return get_path(CUSTOMIZABLE_TYPES);
}
+hidden_def(selinux_customizable_types_path)
const char *selinux_contexts_path() {
return get_path(CONTEXTS_DIR);
Index: libselinux/src/selinux_internal.h
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/libselinux/src/selinux_internal.h,v
retrieving revision 1.2
diff -u -p -r1.2 selinux_internal.h
--- libselinux/src/selinux_internal.h 5 Oct 2004 20:31:50 -0000 1.2
+++ libselinux/src/selinux_internal.h 19 Jan 2005 16:12:17 -0000
@@ -20,3 +20,4 @@ hidden_proto(selinux_removable_context_p
hidden_proto(selinux_file_context_path)
hidden_proto(selinux_user_contexts_path)
hidden_proto(selinux_booleans_path)
+hidden_proto(selinux_customizable_types_path)
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: Added is_context_configurable function
2005-01-12 14:19 ` Stephen Smalley
2005-01-12 14:44 ` Daniel J Walsh
2005-01-12 15:37 ` Daniel J Walsh
@ 2005-01-12 15:39 ` Daniel J Walsh
2005-01-20 15:32 ` Stephen Smalley
2005-01-12 15:48 ` Colin Walters
2005-01-12 18:19 ` Luke Kenneth Casson Leighton
4 siblings, 1 reply; 25+ messages in thread
From: Daniel J Walsh @ 2005-01-12 15:39 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Colin Walters, SELinux
[-- Attachment #1: Type: text/plain, Size: 121 bytes --]
Patch to policycoreutils so restorecon/setfiles can handle
customizable_types.
Also fix a segfault in restorecon.
Dan
[-- Attachment #2: policycoreutils-rhat.patch --]
[-- Type: text/x-patch, Size: 6189 bytes --]
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecon/restorecon.8 policycoreutils-1.20.1/restorecon/restorecon.8
--- nsapolicycoreutils/restorecon/restorecon.8 2004-10-06 09:47:27.000000000 -0400
+++ policycoreutils-1.20.1/restorecon/restorecon.8 2005-01-12 09:34:55.756460549 -0500
@@ -7,7 +7,7 @@
.I [\-o outfilename ] [\-R] [\-n] [\-v] pathname...
.P
.B restorecon
-.I \-f infilename [\-o outfilename ] [\-R] [\-n] [\-v]
+.I \-f infilename [\-o outfilename ] [\-R] [\-n] [\-v] [\-F]
.SH "DESCRIPTION"
This manual page describes the
@@ -38,6 +38,12 @@
.B \-v
show changes in file labels.
.TP
+.B \-vv
+show changes in file labels, if type, role, or user are changing.
+.TP
+.B \-F
+Force reset of context to match file_context for customizable files
+.TP
.SH "ARGUMENTS"
.B pathname...
The pathname for the file(s) to be relabeled.
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/restorecon/restorecon.c policycoreutils-1.20.1/restorecon/restorecon.c
--- nsapolicycoreutils/restorecon/restorecon.c 2005-01-07 09:42:39.000000000 -0500
+++ policycoreutils-1.20.1/restorecon/restorecon.c 2005-01-12 09:34:55.758460325 -0500
@@ -13,6 +13,7 @@
* -n Do not change any file labels.
* -v Show changes in file labels.
* -o filename save list of files with incorrect context
+ * -F Force reset of context to match file_context for customizable files
*
* pathname... The file(s) to label
*
@@ -41,13 +42,16 @@
static FILE *outfile=NULL;
static char *progname;
static int errors=0;
-static int recurse;
+static int recurse=0;
+static int force=0;
/* Compare two contexts to see if their differences are "significant",
* or whether the only difference is in the user. */
static int only_changed_user(const char *a, const char *b)
{
char *rest_a, *rest_b; /* Rest of the context after the user */
+ if (!a || !b)
+ return 0;
rest_a = strchr(a, ':');
rest_b = strchr(b, ':');
if (!rest_a || !rest_b)
@@ -128,7 +132,10 @@
retcontext=lgetfilecon(filename,&prev_context);
if (retcontext >= 0 || errno == ENODATA) {
- if (retcontext < 0 || strcmp(prev_context,scontext) != 0) {
+ int customizable=0;
+ if (retcontext < 0 ||
+ (strcmp(prev_context,scontext) != 0 &&
+ (customizable=(force ? 0: is_context_customizable(prev_context))==0))) {
if (outfile) {
fprintf(outfile, "%s\n", filename);
}
@@ -143,11 +150,16 @@
freecon(scontext);
return 1;
} else
- if (verbose > 1 ||
- !only_changed_user(scontext, prev_context))
- fprintf(stderr,"%s reset context %s:%s->%s\n",
- progname, filename, prev_context, scontext);
- }
+ if (verbose &&
+ (verbose > 1 || !only_changed_user(scontext, prev_context)))
+ fprintf(stderr,"%s reset context %s:%s->%s\n",
+ progname, filename, (retcontext >= 0 ? prev_context : ""), scontext);
+ }
+ if (verbose > 1 && customizable>0) {
+ fprintf(stderr,"%s: %s not reset customized by admin to %s\n",
+ progname, filename, prev_context);
+ }
+
if (retcontext >= 0)
freecon(prev_context);
}
@@ -197,7 +209,7 @@
memset(buf,0, sizeof(buf));
- while ((opt = getopt(argc, argv, "Rnvf:o:")) > 0) {
+ while ((opt = getopt(argc, argv, "FRnvf:o:")) > 0) {
switch (opt) {
case 'n':
change = 0;
@@ -205,6 +217,9 @@
case 'R':
recurse = 1;
break;
+ case 'F':
+ force = 1;
+ break;
case 'o':
outfile = fopen(optarg,"w");
if (!outfile) {
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/setfiles/setfiles.8 policycoreutils-1.20.1/setfiles/setfiles.8
--- nsapolicycoreutils/setfiles/setfiles.8 2004-10-06 09:47:28.000000000 -0400
+++ policycoreutils-1.20.1/setfiles/setfiles.8 2005-01-12 09:34:55.759460213 -0500
@@ -4,7 +4,7 @@
.SH "SYNOPSIS"
.B setfiles
-.I [\-d] [\-l] [\-n] [\-e directory ] [\-o filename ] [\-q] [\-s] [\-v] [\-vv] [\-W] spec_file pathname...
+.I [\-d] [\-l] [\-n] [\-e directory ] [\-o filename ] [\-q] [\-s] [\-v] [\-vv] [\-W] [\F] spec_file pathname...
.SH "DESCRIPTION"
This manual page describes the
.BR setfiles
@@ -35,6 +35,9 @@
.B \-e directory
directory to exclude (repeat option for more than one directory.)
.TP
+.B \-F
+Force reset of context to match file_context for customizable files
+.TP
.B \-o filename
save list of files with incorrect context in filename.
.TP
@@ -44,6 +47,7 @@
.TP
.B \-v
show changes in file labels, if type or role are changing.
+.TP
.B \-vv
show changes in file labels, if type, role, or user are changing.
.TP
diff --exclude-from=exclude -N -u -r nsapolicycoreutils/setfiles/setfiles.c policycoreutils-1.20.1/setfiles/setfiles.c
--- nsapolicycoreutils/setfiles/setfiles.c 2004-10-06 09:47:28.000000000 -0400
+++ policycoreutils-1.20.1/setfiles/setfiles.c 2005-01-12 09:34:55.761459989 -0500
@@ -15,6 +15,7 @@
* setfiles [-dnpqsvW] [-e directory ] [-c policy] [-o filename ] spec_file pathname...
*
* -e Specify directory to exclude
+ * -F Force reset of context to match file_context for customizable files
* -c Verify the specification file using a binary policy
* -d Show what specification matched each file.
* -l Log changes in files labels to syslog.
@@ -76,6 +77,7 @@
static int add_assoc = 1;
static FILE *outfile=NULL;
+static int force=0;
#define MAX_EXCLUDES 100
static int excludeCtr=0;
@@ -675,6 +677,15 @@
return 0;
}
+ if (! force &&
+ ( is_context_customizable(context)>0 )) {
+ if (verbose > 1) {
+ fprintf(stderr,"%s: %s not reset customized by admin to %s\n",
+ progname, my_file, context);
+ }
+ return 0;
+ }
+
if (verbose) {
/* If we're just doing "-v", trim out any relabels where
* the user has changed but the role and type are the
@@ -775,7 +786,7 @@
memset(excludeArray,0, sizeof(excludeArray));
/* Process any options. */
- while ((opt = getopt(argc, argv, "c:dlnqrsvWe:o:")) > 0) {
+ while ((opt = getopt(argc, argv, "Fc:dlnqrsvWe:o:")) > 0) {
switch (opt) {
case 'c':
{
@@ -837,6 +848,9 @@
case 'l':
log = 1;
break;
+ case 'F':
+ force = 1;
+ break;
case 'n':
change = 0;
break;
^ permalink raw reply [flat|nested] 25+ messages in thread* Re: Added is_context_configurable function
2005-01-12 15:39 ` Daniel J Walsh
@ 2005-01-20 15:32 ` Stephen Smalley
0 siblings, 0 replies; 25+ messages in thread
From: Stephen Smalley @ 2005-01-20 15:32 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Colin Walters, SELinux
[-- Attachment #1: Type: text/plain, Size: 492 bytes --]
On Wed, 2005-01-12 at 10:39, Daniel J Walsh wrote:
> Patch to policycoreutils so restorecon/setfiles can handle
> customizable_types.
>
> Also fix a segfault in restorecon.
Thanks, merged into sourceforge CVS as of policycoreutils version
1.21.1, depends on libselinux 1.21.1, along with the modifications below
relative to your patch. Note that setfiles and rpm still need to be
modified for file_contexts.local support.
--
Stephen Smalley <sds@tycho.nsa.gov>
National Security Agency
[-- Attachment #2: policycoreutils-fixes.patch --]
[-- Type: text/x-patch, Size: 764 bytes --]
Index: policycoreutils/restorecon/restorecon.c
===================================================================
RCS file: /nfshome/pal/CVS/selinux-usr/policycoreutils/restorecon/restorecon.c,v
retrieving revision 1.19
diff -u -p -r1.19 restorecon.c
--- policycoreutils/restorecon/restorecon.c 19 Jan 2005 16:48:41 -0000 1.19
+++ policycoreutils/restorecon/restorecon.c 19 Jan 2005 17:23:20 -0000
@@ -135,7 +135,7 @@ int restore(char *filename) {
int customizable=0;
if (retcontext < 0 ||
(strcmp(prev_context,scontext) != 0 &&
- (customizable=(force ? 0: is_context_customizable(prev_context))==0))) {
+ !(customizable=(force ? 0: is_context_customizable(prev_context))))) {
if (outfile) {
fprintf(outfile, "%s\n", filename);
}
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: Added is_context_configurable function
2005-01-12 14:19 ` Stephen Smalley
` (2 preceding siblings ...)
2005-01-12 15:39 ` Daniel J Walsh
@ 2005-01-12 15:48 ` Colin Walters
2005-01-12 22:09 ` Stephen Smalley
2005-01-12 18:19 ` Luke Kenneth Casson Leighton
4 siblings, 1 reply; 25+ messages in thread
From: Colin Walters @ 2005-01-12 15:48 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Daniel J Walsh, SELinux
On Wed, 2005-01-12 at 09:19 -0500, Stephen Smalley wrote:
> On Tue, 2005-01-11 at 17:10, Colin Walters wrote:
> > I've said this before, but I don't like the idea of having to edit
> > file_contexts whenever I want to change the labels. I feel that the
> > on-disk version should be canonical, and the file_contexts only used for
> > system initialization.
>
> That is also my view. However, if people are going to run setfiles or
> restorecon at runtime to check or set contexts (which is current
> practice in Fedora), then we do need a way to distinguish legitimate
> customizations from what are essentially bugs in the policy
Right.
> Two questions:
> 1) Is it sufficient to identify legitimate customizations based solely
> on the TE type of the file?
Actually, thinking about this a bit: probably not. On my system I have
several times changed the SELinux user identity component of file
contexts from the default system_u to e.g. foo_u. The reason is that
the constraints prevent a user from relabeling a file unless the SELinux
user matches. So a list of alternate types would not be sufficient in
this case.
> If not, what other information should be
> taken into account, irrespective of whether this is done via
> file_contexts or via a different config file?
It seems the SELinux uid, for one. Also perhaps whether or not the
pathname is part of the standard filesystem. There seems to me to be a
difference between a very well known file such as /etc/shadow being
mislabeled according to file_contexts versus an unknown path such
as /apps/web/blah.
> 2) Is it feasible for the policy writer to identify all such TE types a
> priori in the policy without covering such a large set as to make
> setfiles/restorecon completely useless by default?
My intuition is yes. I think there's a clear difference between types
such as httpd_staff_script_ro_t and dhcpd_var_run_t. The latter is very
much like an implementation detail, something sysadmins generally should
never have to change. Dan identified a reasonable starting set in his
initial patch.
> If not, what
> mechanism will be provided to allow users/admins to easily mark
> additional types without conflicting with future policy updates?
Hmm. This seems to me to be another instance of the whole general
problem of maintaining a policy source delta. Right now we essentially
don't support it.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread* Re: Added is_context_configurable function
2005-01-12 15:48 ` Colin Walters
@ 2005-01-12 22:09 ` Stephen Smalley
2005-01-13 3:52 ` Colin Walters
2005-01-13 14:57 ` Daniel J Walsh
0 siblings, 2 replies; 25+ messages in thread
From: Stephen Smalley @ 2005-01-12 22:09 UTC (permalink / raw)
To: Colin Walters; +Cc: Daniel J Walsh, SELinux
On Wed, 2005-01-12 at 10:48, Colin Walters wrote:
> Actually, thinking about this a bit: probably not. On my system I have
> several times changed the SELinux user identity component of file
> contexts from the default system_u to e.g. foo_u. The reason is that
> the constraints prevent a user from relabeling a file unless the SELinux
> user matches. So a list of alternate types would not be sufficient in
> this case.
<snip>
> It seems the SELinux uid, for one. Also perhaps whether or not the
> pathname is part of the standard filesystem. There seems to me to be a
> difference between a very well known file such as /etc/shadow being
> mislabeled according to file_contexts versus an unknown path such
> as /apps/web/blah.
Ok, so I take this to mean that I should await a new patchset from Dan
that supports this more general way of specifying customizable contexts
based on a combination of type, user identity, and file location. Yes?
--
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: Added is_context_configurable function
2005-01-12 22:09 ` Stephen Smalley
@ 2005-01-13 3:52 ` Colin Walters
2005-01-13 14:55 ` Daniel J Walsh
2005-01-13 14:57 ` Daniel J Walsh
1 sibling, 1 reply; 25+ messages in thread
From: Colin Walters @ 2005-01-13 3:52 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Daniel J Walsh, SELinux
On Wed, 2005-01-12 at 17:09 -0500, Stephen Smalley wrote:
> On Wed, 2005-01-12 at 10:48, Colin Walters wrote:
> > Actually, thinking about this a bit: probably not. On my system I have
> > several times changed the SELinux user identity component of file
> > contexts from the default system_u to e.g. foo_u. The reason is that
> > the constraints prevent a user from relabeling a file unless the SELinux
> > user matches. So a list of alternate types would not be sufficient in
> > this case.
> <snip>
> > It seems the SELinux uid, for one. Also perhaps whether or not the
> > pathname is part of the standard filesystem. There seems to me to be a
> > difference between a very well known file such as /etc/shadow being
> > mislabeled according to file_contexts versus an unknown path such
> > as /apps/web/blah.
>
> Ok, so I take this to mean that I should await a new patchset from Dan
> that supports this more general way of specifying customizable contexts
> based on a combination of type, user identity, and file location. Yes?
This is a complex issue, given we've been going back and forth on this
for months now, with several proposed patches. The last time this came
up in October, you posted a good message:
http://marc.theaimsgroup.com/?l=selinux&m=109872521815476&w=2
You say:
> The file_contexts configuration and setfiles were only intended to
> initialize the system, as previously noted. After installation, one
> should only do a make relabel upon a major policy upgrade, and even in
> that case, it would be better to selectively relabel based on the
> differences between the policies.
And I couldn't agree more. If we can get to the point where we never
(and I really mean never!) tell users to run "fixfiles relabel", I think
a lot of these problems would essentially just go away. I brainstormed
a bit in another message in this thread about how we can avoid it for
policy upgrades, which I believe is the major cause. I'll follow up to
that in a bit.
Let's assume for now that we've successfully gotten rid of fixfiles (at
least from the user's perspective; it may exist as an implementation
detail). At that point, what problems remain? The problem of user-
customizable types like httpd_sys_script_ro_t in well-known areas such
as /var/www being reset to httpd_sys_content_t goes away, because there
is nothing to reset them. The problem of user-defined locations such
as /web/mysite1 with type httpd_sys_content_t being reset to default_t
goes away as well. Are there any other problems?
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: Added is_context_configurable function
2005-01-13 3:52 ` Colin Walters
@ 2005-01-13 14:55 ` Daniel J Walsh
2005-01-13 15:53 ` Colin Walters
0 siblings, 1 reply; 25+ messages in thread
From: Daniel J Walsh @ 2005-01-13 14:55 UTC (permalink / raw)
To: Colin Walters; +Cc: Stephen Smalley, SELinux
Colin Walters wrote:
>On Wed, 2005-01-12 at 17:09 -0500, Stephen Smalley wrote:
>
>
>>On Wed, 2005-01-12 at 10:48, Colin Walters wrote:
>>
>>
>>>Actually, thinking about this a bit: probably not. On my system I have
>>>several times changed the SELinux user identity component of file
>>>contexts from the default system_u to e.g. foo_u. The reason is that
>>>the constraints prevent a user from relabeling a file unless the SELinux
>>>user matches. So a list of alternate types would not be sufficient in
>>>this case.
>>>
>>>
>><snip>
>>
>>
>>>It seems the SELinux uid, for one. Also perhaps whether or not the
>>>pathname is part of the standard filesystem. There seems to me to be a
>>>difference between a very well known file such as /etc/shadow being
>>>mislabeled according to file_contexts versus an unknown path such
>>>as /apps/web/blah.
>>>
>>>
>>Ok, so I take this to mean that I should await a new patchset from Dan
>>that supports this more general way of specifying customizable contexts
>>based on a combination of type, user identity, and file location. Yes?
>>
>>
>
>This is a complex issue, given we've been going back and forth on this
>for months now, with several proposed patches. The last time this came
>up in October, you posted a good message:
>
>http://marc.theaimsgroup.com/?l=selinux&m=109872521815476&w=2
>
>You say:
>
>
>
>>The file_contexts configuration and setfiles were only intended to
>>initialize the system, as previously noted. After installation, one
>>should only do a make relabel upon a major policy upgrade, and even in
>>that case, it would be better to selectively relabel based on the
>>differences between the policies.
>>
>>
>
>And I couldn't agree more. If we can get to the point where we never
>(and I really mean never!) tell users to run "fixfiles relabel", I think
>a lot of these problems would essentially just go away. I brainstormed
>a bit in another message in this thread about how we can avoid it for
>policy upgrades, which I believe is the major cause. I'll follow up to
>that in a bit.
>
>Let's assume for now that we've successfully gotten rid of fixfiles (at
>least from the user's perspective; it may exist as an implementation
>detail). At that point, what problems remain? The problem of user-
>customizable types like httpd_sys_script_ro_t in well-known areas such
>as /var/www being reset to httpd_sys_content_t goes away, because there
>is nothing to reset them. The problem of user-defined locations such
>as /web/mysite1 with type httpd_sys_content_t being reset to default_t
>goes away as well. Are there any other problems?
>
>
>
>
>
You loose the ability to do something like fixfiles.cron. I removed it
because it was bringing
back too many false positives, and some people complained that they do
not trust that the file
contexts aren't being modified.
Dan
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: Added is_context_configurable function
2005-01-13 14:55 ` Daniel J Walsh
@ 2005-01-13 15:53 ` Colin Walters
2005-01-13 16:01 ` Daniel J Walsh
0 siblings, 1 reply; 25+ messages in thread
From: Colin Walters @ 2005-01-13 15:53 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SELinux
On Thu, 2005-01-13 at 09:55 -0500, Daniel J Walsh wrote:
> You loose the ability to do something like fixfiles.cron. I removed it
> because it was bringing
> back too many false positives, and some people complained that they do
> not trust that the file
> contexts aren't being modified.
Okay; are you saying you want to bring it back? I don't see anything
inherently wrong with simply warning on contexts that differ from the
expected, particularly if we limit it to well-known critical directories
such as /etc. What does seem wrong is relabeling all known files any
time we encounter a labeling issue.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: Added is_context_configurable function
2005-01-13 15:53 ` Colin Walters
@ 2005-01-13 16:01 ` Daniel J Walsh
0 siblings, 0 replies; 25+ messages in thread
From: Daniel J Walsh @ 2005-01-13 16:01 UTC (permalink / raw)
To: Colin Walters; +Cc: Stephen Smalley, SELinux
Colin Walters wrote:
>On Thu, 2005-01-13 at 09:55 -0500, Daniel J Walsh wrote:
>
>
>
>>You loose the ability to do something like fixfiles.cron. I removed it
>>because it was bringing
>>back too many false positives, and some people complained that they do
>>not trust that the file
>>contexts aren't being modified.
>>
>>
>
>Okay; are you saying you want to bring it back? I don't see anything
>inherently wrong with simply warning on contexts that differ from the
>expected, particularly if we limit it to well-known critical directories
>such as /etc. What does seem wrong is relabeling all known files any
>time we encounter a labeling issue.
>
>
>
>
Yes, I would like to bring back something to tell me the policy is
working correctly. Right now
I don't think we have a great understanding of how the file context are
being labeled. IE What
relabels /etc/mtab to etc_t instead of etc_runtime_t?
I agree the fixfiles relabel has got to go. But most of the problems we
are seeing of relabel are either
yum upgrade blew away shlib_t or policy was broken and an update would
fix it but you need to relabel
/var/lib/mysql ...
Hopefully policy will eventually stabelize and we can find the yum
upgrade problem. Then the fixfiles.cron
type application could reveal potential security vulnerabilities.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: Added is_context_configurable function
2005-01-12 22:09 ` Stephen Smalley
2005-01-13 3:52 ` Colin Walters
@ 2005-01-13 14:57 ` Daniel J Walsh
1 sibling, 0 replies; 25+ messages in thread
From: Daniel J Walsh @ 2005-01-13 14:57 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Colin Walters, SELinux
Stephen Smalley wrote:
>On Wed, 2005-01-12 at 10:48, Colin Walters wrote:
>
>
>>Actually, thinking about this a bit: probably not. On my system I have
>>several times changed the SELinux user identity component of file
>>contexts from the default system_u to e.g. foo_u. The reason is that
>>the constraints prevent a user from relabeling a file unless the SELinux
>>user matches. So a list of alternate types would not be sufficient in
>>this case.
>>
>>
><snip>
>
>
>>It seems the SELinux uid, for one. Also perhaps whether or not the
>>pathname is part of the standard filesystem. There seems to me to be a
>>difference between a very well known file such as /etc/shadow being
>>mislabeled according to file_contexts versus an unknown path such
>>as /apps/web/blah.
>>
>>
>
>Ok, so I take this to mean that I should await a new patchset from Dan
>that supports this more general way of specifying customizable contexts
>based on a combination of type, user identity, and file location. Yes?
>
>
>
No. I gave a patch to handle user customizable file_context
(file_context.local) which will sort of do this.
Restorecon/setfiles currently modify the user section of the
file_context which should stop unless you specify a -F
this would preserve the functionality that Colin wants.
Dan
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread
* Re: Added is_context_configurable function
2005-01-12 14:19 ` Stephen Smalley
` (3 preceding siblings ...)
2005-01-12 15:48 ` Colin Walters
@ 2005-01-12 18:19 ` Luke Kenneth Casson Leighton
2005-01-12 18:15 ` Colin Walters
4 siblings, 1 reply; 25+ messages in thread
From: Luke Kenneth Casson Leighton @ 2005-01-12 18:19 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Colin Walters, Daniel J Walsh, SELinux
On Wed, Jan 12, 2005 at 09:19:15AM -0500, Stephen Smalley wrote:
> On Tue, 2005-01-11 at 17:10, Colin Walters wrote:
> > I've said this before, but I don't like the idea of having to edit
> > file_contexts whenever I want to change the labels. I feel that the
> > on-disk version should be canonical, and the file_contexts only used for
> > system initialization.
>
> That is also my view. However, if people are going to run setfiles or
> restorecon at runtime to check or set contexts (which is current
> practice in Fedora), then we do need a way to distinguish legitimate
> customizations
... so there _is_ actually a genuine requirement to minimise the
number of changes to policy files?
l.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread* Re: Added is_context_configurable function
2005-01-12 18:19 ` Luke Kenneth Casson Leighton
@ 2005-01-12 18:15 ` Colin Walters
0 siblings, 0 replies; 25+ messages in thread
From: Colin Walters @ 2005-01-12 18:15 UTC (permalink / raw)
To: Luke Kenneth Casson Leighton; +Cc: Stephen Smalley, Daniel J Walsh, SELinux
On Wed, 2005-01-12 at 18:19 +0000, Luke Kenneth Casson Leighton wrote:
> On Wed, Jan 12, 2005 at 09:19:15AM -0500, Stephen Smalley wrote:
> > On Tue, 2005-01-11 at 17:10, Colin Walters wrote:
> > > I've said this before, but I don't like the idea of having to edit
> > > file_contexts whenever I want to change the labels. I feel that the
> > > on-disk version should be canonical, and the file_contexts only used for
> > > system initialization.
> >
> > That is also my view. However, if people are going to run setfiles or
> > restorecon at runtime to check or set contexts (which is current
> > practice in Fedora), then we do need a way to distinguish legitimate
> > customizations
>
> ... so there _is_ actually a genuine requirement to minimise the
> number of changes to policy files?
There is certainly a desire to do so, particularly for the targeted
policy that Fedora ships by default. We're trying to get common
configuration changes (e.g. named writing zone files, using ypbind,
httpd reading homedirs) mapped into booleans, so there's no need for
administrators to install the policy source and rebuild. This makes
management a lot easier.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 25+ messages in thread