* Patch for restorecond to not report an error if filesystem does not support XATTR
@ 2006-11-29 22:18 Daniel J Walsh
2006-11-30 16:25 ` Joshua Brindle
2006-12-06 17:19 ` Karl MacMillan
0 siblings, 2 replies; 9+ messages in thread
From: Daniel J Walsh @ 2006-11-29 22:18 UTC (permalink / raw)
To: Stephen Smalley, Joshua Brindle, SE Linux
[-- Attachment #1: Type: text/plain, Size: 34 bytes --]
Caused by NFS Home directories.
[-- Attachment #2: restorecond-eopnotsupp.patch --]
[-- Type: text/x-patch, Size: 1108 bytes --]
diff --exclude-from=exclude --exclude POTFILES.in --exclude='*.po' --exclude='*.pot' -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-1.33.5/restorecond/restorecond.c
--- nsapolicycoreutils/restorecond/restorecond.c 2006-11-16 17:14:28.000000000 -0500
+++ policycoreutils-1.33.5/restorecond/restorecond.c 2006-11-29 12:44:06.000000000 -0500
@@ -210,9 +210,10 @@
}
if (fsetfilecon(fd, scontext) < 0) {
- syslog(LOG_ERR,
- "set context %s->%s failed:'%s'\n",
- filename, scontext, strerror(errno));
+ if (errno != EOPNOTSUPP)
+ syslog(LOG_ERR,
+ "set context %s->%s failed:'%s'\n",
+ filename, scontext, strerror(errno));
if (retcontext >= 0)
free(prev_context);
free(scontext);
@@ -225,8 +226,9 @@
if (retcontext >= 0)
free(prev_context);
} else {
- syslog(LOG_ERR, "get context on %s failed: '%s'\n",
- filename, strerror(errno));
+ if (errno != EOPNOTSUPP)
+ syslog(LOG_ERR, "get context on %s failed: '%s'\n",
+ filename, strerror(errno));
}
free(scontext);
close(fd);
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: Patch for restorecond to not report an error if filesystem does not support XATTR
2006-11-29 22:18 Patch for restorecond to not report an error if filesystem does not support XATTR Daniel J Walsh
@ 2006-11-30 16:25 ` Joshua Brindle
2006-11-30 17:06 ` Daniel J Walsh
2006-12-06 17:19 ` Karl MacMillan
1 sibling, 1 reply; 9+ messages in thread
From: Joshua Brindle @ 2006-11-30 16:25 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SE Linux
Daniel J Walsh wrote:
> Caused by NFS Home directories.
>
>
>
> ------------------------------------------------------------------------
>
> diff --exclude-from=exclude --exclude POTFILES.in --exclude='*.po' --exclude='*.pot' -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-1.33.5/restorecond/restorecond.c
> --- nsapolicycoreutils/restorecond/restorecond.c 2006-11-16 17:14:28.000000000 -0500
> +++ policycoreutils-1.33.5/restorecond/restorecond.c 2006-11-29 12:44:06.000000000 -0500
> @@ -210,9 +210,10 @@
> }
>
> if (fsetfilecon(fd, scontext) < 0) {
> - syslog(LOG_ERR,
> - "set context %s->%s failed:'%s'\n",
> - filename, scontext, strerror(errno));
> + if (errno != EOPNOTSUPP)
> + syslog(LOG_ERR,
> + "set context %s->%s failed:'%s'\n",
> + filename, scontext, strerror(errno));
> if (retcontext >= 0)
> free(prev_context);
> free(scontext);
> @@ -225,8 +226,9 @@
> if (retcontext >= 0)
> free(prev_context);
> } else {
> - syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> - filename, strerror(errno));
> + if (errno != EOPNOTSUPP)
> + syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> + filename, strerror(errno));
> }
> free(scontext);
> close(fd);
It sounds like this is caused by configuration errors, why wouldn't it
check that the files/dirs being watched have xattr support before adding
them to the watch list?
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: Patch for restorecond to not report an error if filesystem does not support XATTR
2006-11-30 16:25 ` Joshua Brindle
@ 2006-11-30 17:06 ` Daniel J Walsh
2006-11-30 18:15 ` Joshua Brindle
0 siblings, 1 reply; 9+ messages in thread
From: Daniel J Walsh @ 2006-11-30 17:06 UTC (permalink / raw)
To: Joshua Brindle; +Cc: Stephen Smalley, SE Linux
Joshua Brindle wrote:
> Daniel J Walsh wrote:
>> Caused by NFS Home directories.
>>
>>
>>
>> ------------------------------------------------------------------------
>>
>> diff --exclude-from=exclude --exclude POTFILES.in --exclude='*.po'
>> --exclude='*.pot' -N -u -r
>> nsapolicycoreutils/restorecond/restorecond.c
>> policycoreutils-1.33.5/restorecond/restorecond.c
>> --- nsapolicycoreutils/restorecond/restorecond.c 2006-11-16
>> 17:14:28.000000000 -0500
>> +++ policycoreutils-1.33.5/restorecond/restorecond.c 2006-11-29
>> 12:44:06.000000000 -0500
>> @@ -210,9 +210,10 @@
>> }
>>
>> if (fsetfilecon(fd, scontext) < 0) {
>> - syslog(LOG_ERR,
>> - "set context %s->%s failed:'%s'\n",
>> - filename, scontext, strerror(errno));
>> + if (errno != EOPNOTSUPP) +
>> syslog(LOG_ERR,
>> + "set context %s->%s failed:'%s'\n",
>> + filename, scontext, strerror(errno));
>> if (retcontext >= 0)
>> free(prev_context);
>> free(scontext);
>> @@ -225,8 +226,9 @@
>> if (retcontext >= 0)
>> free(prev_context);
>> } else {
>> - syslog(LOG_ERR, "get context on %s failed: '%s'\n",
>> - filename, strerror(errno));
>> + if (errno != EOPNOTSUPP) + syslog(LOG_ERR, "get
>> context on %s failed: '%s'\n",
>> + filename, strerror(errno));
>> }
>> free(scontext);
>> close(fd);
>
> It sounds like this is caused by configuration errors, why wouldn't it
> check that the files/dirs being watched have xattr support before
> adding them to the watch list?
>
I guess we can check before we add the directory to watch. How do you
check if a directory supports file_context without setting the file context?
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 9+ messages in thread* RE: Patch for restorecond to not report an error if filesystem does not support XATTR
2006-11-30 17:06 ` Daniel J Walsh
@ 2006-11-30 18:15 ` Joshua Brindle
2006-11-30 19:02 ` Stephen Smalley
0 siblings, 1 reply; 9+ messages in thread
From: Joshua Brindle @ 2006-11-30 18:15 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, SE Linux
> From: Daniel J Walsh [mailto:dwalsh@redhat.com]
>
> Joshua Brindle wrote:
> > Daniel J Walsh wrote:
> >> Caused by NFS Home directories.
> >>
> ---------------------------------------------------------------------
> >> ---
> >>
> >> diff --exclude-from=exclude --exclude POTFILES.in --exclude='*.po'
> >> --exclude='*.pot' -N -u -r
> >> nsapolicycoreutils/restorecond/restorecond.c
> >> policycoreutils-1.33.5/restorecond/restorecond.c
> >> --- nsapolicycoreutils/restorecond/restorecond.c 2006-11-16
> >> 17:14:28.000000000 -0500
> >> +++ policycoreutils-1.33.5/restorecond/restorecond.c 2006-11-29
> >> 12:44:06.000000000 -0500
> >> @@ -210,9 +210,10 @@
> >> }
> >>
> >> if (fsetfilecon(fd, scontext) < 0) {
> >> - syslog(LOG_ERR,
> >> - "set context %s->%s failed:'%s'\n",
> >> - filename, scontext, strerror(errno));
> >> + if (errno != EOPNOTSUPP) +
> >> syslog(LOG_ERR,
> >> + "set context %s->%s failed:'%s'\n",
> >> + filename, scontext, strerror(errno));
> >> if (retcontext >= 0)
> >> free(prev_context);
> >> free(scontext);
> >> @@ -225,8 +226,9 @@
> >> if (retcontext >= 0)
> >> free(prev_context);
> >> } else {
> >> - syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> >> - filename, strerror(errno));
> >> + if (errno != EOPNOTSUPP) +
> syslog(LOG_ERR, "get
> >> context on %s failed: '%s'\n",
> >> + filename, strerror(errno));
> >> }
> >> free(scontext);
> >> close(fd);
> >
> > It sounds like this is caused by configuration errors, why
> wouldn't it
> > check that the files/dirs being watched have xattr support before
> > adding them to the watch list?
> >
> I guess we can check before we add the directory to watch.
> How do you check if a directory supports file_context without
> setting the file context?
>
Good question, this may be yet-another-thing messed up by the
canonicalized selinux contexts since getxattr will return the actual
label and not necessarilly the one on disk (or an error if the
filesystem doesn't support it).
Stephen might know a better way to figure out if a filesystem supports
xattr labeling from userland, otherwise I guess the above patch is
better than flooding the logs (though it won't give the user an
indication why restorecond isn't doing what he thinks it should be), I'd
really rather us figure out a way to report a configuration error to the
user than hide the problem.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 9+ messages in thread* RE: Patch for restorecond to not report an error if filesystem does not support XATTR
2006-11-30 18:15 ` Joshua Brindle
@ 2006-11-30 19:02 ` Stephen Smalley
2006-12-02 3:37 ` Joshua Brindle
0 siblings, 1 reply; 9+ messages in thread
From: Stephen Smalley @ 2006-11-30 19:02 UTC (permalink / raw)
To: Joshua Brindle; +Cc: Daniel J Walsh, SE Linux
On Thu, 2006-11-30 at 13:15 -0500, Joshua Brindle wrote:
> > From: Daniel J Walsh [mailto:dwalsh@redhat.com]
> >
> > Joshua Brindle wrote:
> > > Daniel J Walsh wrote:
> > >> Caused by NFS Home directories.
> > >>
> > ---------------------------------------------------------------------
> > >> ---
> > >>
> > >> diff --exclude-from=exclude --exclude POTFILES.in --exclude='*.po'
> > >> --exclude='*.pot' -N -u -r
> > >> nsapolicycoreutils/restorecond/restorecond.c
> > >> policycoreutils-1.33.5/restorecond/restorecond.c
> > >> --- nsapolicycoreutils/restorecond/restorecond.c 2006-11-16
> > >> 17:14:28.000000000 -0500
> > >> +++ policycoreutils-1.33.5/restorecond/restorecond.c 2006-11-29
> > >> 12:44:06.000000000 -0500
> > >> @@ -210,9 +210,10 @@
> > >> }
> > >>
> > >> if (fsetfilecon(fd, scontext) < 0) {
> > >> - syslog(LOG_ERR,
> > >> - "set context %s->%s failed:'%s'\n",
> > >> - filename, scontext, strerror(errno));
> > >> + if (errno != EOPNOTSUPP) +
> > >> syslog(LOG_ERR,
> > >> + "set context %s->%s failed:'%s'\n",
> > >> + filename, scontext, strerror(errno));
> > >> if (retcontext >= 0)
> > >> free(prev_context);
> > >> free(scontext);
> > >> @@ -225,8 +226,9 @@
> > >> if (retcontext >= 0)
> > >> free(prev_context);
> > >> } else {
> > >> - syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> > >> - filename, strerror(errno));
> > >> + if (errno != EOPNOTSUPP) +
> > syslog(LOG_ERR, "get
> > >> context on %s failed: '%s'\n",
> > >> + filename, strerror(errno));
> > >> }
> > >> free(scontext);
> > >> close(fd);
> > >
> > > It sounds like this is caused by configuration errors, why
> > wouldn't it
> > > check that the files/dirs being watched have xattr support before
> > > adding them to the watch list?
> > >
> > I guess we can check before we add the directory to watch.
> > How do you check if a directory supports file_context without
> > setting the file context?
> >
>
> Good question, this may be yet-another-thing messed up by the
> canonicalized selinux contexts since getxattr will return the actual
> label and not necessarilly the one on disk (or an error if the
> filesystem doesn't support it).
>
> Stephen might know a better way to figure out if a filesystem supports
> xattr labeling from userland, otherwise I guess the above patch is
> better than flooding the logs (though it won't give the user an
> indication why restorecond isn't doing what he thinks it should be), I'd
> really rather us figure out a way to report a configuration error to the
> user than hide the problem.
Interesting question...the policy Makefile and the fixfiles script have
always just used a hardcoded list of filesystem types known to support
file security labeling. And the policy configuration explicitly
specifies the filesystem types for which SELinux tries to use xattrs, as
the mere presence of an xattr handler has never been a sufficient test.
Possibly we should be extracting that list from policy and making it
available for programs that need to know it.
Even testing the result of setxattr for EOPNOTSUPP is not 100%, as
setxattr will also fall back to setting the incore value if a) you pass
permission checks and b) the filesystem provides no setxattr method at
all (NFS happens to provide one, but it only supports ACLs). So it
could succeed (e.g. devpts nodes) or fail with -EACCES (e.g. proc).
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: Patch for restorecond to not report an error if filesystem does not support XATTR
2006-11-30 19:02 ` Stephen Smalley
@ 2006-12-02 3:37 ` Joshua Brindle
2006-12-04 20:10 ` Stephen Smalley
0 siblings, 1 reply; 9+ messages in thread
From: Joshua Brindle @ 2006-12-02 3:37 UTC (permalink / raw)
To: Stephen Smalley; +Cc: Daniel J Walsh, SE Linux
Stephen Smalley wrote:
>
> Interesting question...the policy Makefile and the fixfiles script have
> always just used a hardcoded list of filesystem types known to support
> file security labeling. And the policy configuration explicitly
> specifies the filesystem types for which SELinux tries to use xattrs, as
> the mere presence of an xattr handler has never been a sufficient test.
> Possibly we should be extracting that list from policy and making it
> available for programs that need to know it.
>
> Even testing the result of setxattr for EOPNOTSUPP is not 100%, as
> setxattr will also fall back to setting the incore value if a) you pass
> permission checks and b) the filesystem provides no setxattr method at
> all (NFS happens to provide one, but it only supports ACLs). So it
> could succeed (e.g. devpts nodes) or fail with -EACCES (e.g. proc).
>
Can we make an selinuxfs node that just outputs the list of fs_use_xattr
filesystems?
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Patch for restorecond to not report an error if filesystem does not support XATTR
2006-12-02 3:37 ` Joshua Brindle
@ 2006-12-04 20:10 ` Stephen Smalley
0 siblings, 0 replies; 9+ messages in thread
From: Stephen Smalley @ 2006-12-04 20:10 UTC (permalink / raw)
To: Joshua Brindle
Cc: Daniel J Walsh, SE Linux, James Morris, Eric Paris,
Christopher J. PeBenito
On Fri, 2006-12-01 at 22:37 -0500, Joshua Brindle wrote:
> Stephen Smalley wrote:
> >
> > Interesting question...the policy Makefile and the fixfiles script have
> > always just used a hardcoded list of filesystem types known to support
> > file security labeling. And the policy configuration explicitly
> > specifies the filesystem types for which SELinux tries to use xattrs, as
> > the mere presence of an xattr handler has never been a sufficient test.
> > Possibly we should be extracting that list from policy and making it
> > available for programs that need to know it.
> >
> > Even testing the result of setxattr for EOPNOTSUPP is not 100%, as
> > setxattr will also fall back to setting the incore value if a) you pass
> > permission checks and b) the filesystem provides no setxattr method at
> > all (NFS happens to provide one, but it only supports ACLs). So it
> > could succeed (e.g. devpts nodes) or fail with -EACCES (e.g. proc).
> >
>
> Can we make an selinuxfs node that just outputs the list of fs_use_xattr
> filesystems?
That could be done. But that will require a kernel patch, whereas you
could just have the policy build process emit the list to a config file
and install it somewhere under /etc/selinux/ for reading by restorecond
and fixfiles (and the policy Makefile could generate the list privately
for its own use for the relabel target).
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: Patch for restorecond to not report an error if filesystem does not support XATTR
2006-11-29 22:18 Patch for restorecond to not report an error if filesystem does not support XATTR Daniel J Walsh
2006-11-30 16:25 ` Joshua Brindle
@ 2006-12-06 17:19 ` Karl MacMillan
2006-12-12 18:18 ` Stephen Smalley
1 sibling, 1 reply; 9+ messages in thread
From: Karl MacMillan @ 2006-12-06 17:19 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: Stephen Smalley, Joshua Brindle, SE Linux
Daniel J Walsh wrote:
> Caused by NFS Home directories.
>
In the absence of some mechanism to determine which file systems support
labeling, do we want to merge this patch or something similar? Would it
be better to remove files from the watch list if a fatal error is
encountered?
Karl
>
>
> ------------------------------------------------------------------------
>
> diff --exclude-from=exclude --exclude POTFILES.in --exclude='*.po' --exclude='*.pot' -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-1.33.5/restorecond/restorecond.c
> --- nsapolicycoreutils/restorecond/restorecond.c 2006-11-16 17:14:28.000000000 -0500
> +++ policycoreutils-1.33.5/restorecond/restorecond.c 2006-11-29 12:44:06.000000000 -0500
> @@ -210,9 +210,10 @@
> }
>
> if (fsetfilecon(fd, scontext) < 0) {
> - syslog(LOG_ERR,
> - "set context %s->%s failed:'%s'\n",
> - filename, scontext, strerror(errno));
> + if (errno != EOPNOTSUPP)
> + syslog(LOG_ERR,
> + "set context %s->%s failed:'%s'\n",
> + filename, scontext, strerror(errno));
> if (retcontext >= 0)
> free(prev_context);
> free(scontext);
> @@ -225,8 +226,9 @@
> if (retcontext >= 0)
> free(prev_context);
> } else {
> - syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> - filename, strerror(errno));
> + if (errno != EOPNOTSUPP)
> + syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> + filename, strerror(errno));
> }
> free(scontext);
> close(fd);
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: Patch for restorecond to not report an error if filesystem does not support XATTR
2006-12-06 17:19 ` Karl MacMillan
@ 2006-12-12 18:18 ` Stephen Smalley
0 siblings, 0 replies; 9+ messages in thread
From: Stephen Smalley @ 2006-12-12 18:18 UTC (permalink / raw)
To: Karl MacMillan; +Cc: Daniel J Walsh, Joshua Brindle, SE Linux
On Wed, 2006-12-06 at 12:19 -0500, Karl MacMillan wrote:
> Daniel J Walsh wrote:
> > Caused by NFS Home directories.
> >
>
> In the absence of some mechanism to determine which file systems support
> labeling, do we want to merge this patch or something similar? Would it
> be better to remove files from the watch list if a fatal error is
> encountered?
As Joshua noted, you could test for the same condition when processing
the configuration before you add the file to the watch list, and issue
an error or warning at that time rather than waiting until you try to
restore the file's context. Just do an open+fgetfilecon followed by a
fsetfilecon to the same context to check for any errors (not just
EOPNOTSUPP) before adding to the watch list. Only corner case is ENOENT
if you want to allow the watch list to include files that may not yet
exist; I suppose you could ignore that one at config processing time.
>
> Karl
>
> >
> >
> > ------------------------------------------------------------------------
> >
> > diff --exclude-from=exclude --exclude POTFILES.in --exclude='*.po' --exclude='*.pot' -N -u -r nsapolicycoreutils/restorecond/restorecond.c policycoreutils-1.33.5/restorecond/restorecond.c
> > --- nsapolicycoreutils/restorecond/restorecond.c 2006-11-16 17:14:28.000000000 -0500
> > +++ policycoreutils-1.33.5/restorecond/restorecond.c 2006-11-29 12:44:06.000000000 -0500
> > @@ -210,9 +210,10 @@
> > }
> >
> > if (fsetfilecon(fd, scontext) < 0) {
> > - syslog(LOG_ERR,
> > - "set context %s->%s failed:'%s'\n",
> > - filename, scontext, strerror(errno));
> > + if (errno != EOPNOTSUPP)
> > + syslog(LOG_ERR,
> > + "set context %s->%s failed:'%s'\n",
> > + filename, scontext, strerror(errno));
> > if (retcontext >= 0)
> > free(prev_context);
> > free(scontext);
> > @@ -225,8 +226,9 @@
> > if (retcontext >= 0)
> > free(prev_context);
> > } else {
> > - syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> > - filename, strerror(errno));
> > + if (errno != EOPNOTSUPP)
> > + syslog(LOG_ERR, "get context on %s failed: '%s'\n",
> > + filename, strerror(errno));
> > }
> > free(scontext);
> > close(fd);
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
> the words "unsubscribe selinux" without quotes as the message.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2006-12-12 18:18 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-11-29 22:18 Patch for restorecond to not report an error if filesystem does not support XATTR Daniel J Walsh
2006-11-30 16:25 ` Joshua Brindle
2006-11-30 17:06 ` Daniel J Walsh
2006-11-30 18:15 ` Joshua Brindle
2006-11-30 19:02 ` Stephen Smalley
2006-12-02 3:37 ` Joshua Brindle
2006-12-04 20:10 ` Stephen Smalley
2006-12-06 17:19 ` Karl MacMillan
2006-12-12 18:18 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.