Re: learning about policies/transitions

[Serge Hallyn <serge.hallyn@gmail.com>]

Addendum:  running setfilecon works once.  After each reboot, I must again run
setfilecon.before /bin/login will cause the transition to login_d. 
Again, running
/bin/ls -Z /bin/login shows no difference before and after the
setifilecon - it is always
of type login_et.

At this point, I suppose I should just switch to the latest fedora deverlopment
release and see whether this problem magically resolves itself.  If
not, I guess some
debug info at d_instantiate will be order.

thanks,
-serge

On Thu, 04 Nov 2004 12:11:06 -0500, Stephen Smalley <sds@epoch.ncsc.mil> wrote:
> On Thu, 2004-11-04 at 11:20, Serge Hallyn wrote:
> > Ah, running setfilecon worked.
> >
> > I don't understand why, though.  The security.selinux xattr (as given by
> > getxattr(2)) looked the same before and after.  What else is being changed
> > by setfilecon?
> 
> The incore inode SID.  setfilecon(1) unconditionally calls
> setfilecon(3), which invokes setxattr(2), which will invoke the
> post_setxattr hook and update the incore inode SID.  setfiles and/or
> chcon would have just looked at the existing on-disk xattr value (via
> getfilecon(3)->getxattr(2)), seen that the on-disk xattr was already
> correct, and not bothered to call setfilecon(3), so the incore inode SID
> wasn't being updated by those programs.  I think RedHat is/has added an
> option to chcon(1) to force the call to setfilecon(3) regardless of its
> current value.  Perhaps setfiles(1) should unconditionally call
> setfilecon(3) too.
> 
> This is an unfortunate side effect of using the xattr API (vs. the
> original SELinux API, which directly fetched the incore inode SID and
> returned it to the caller), because the xattr API always consults the
> filesystem and reports the on-disk xattr.  SELinux maps the on-disk
> xattr to a SID at the time of d_instantiate, but if the on-disk xattr is
> invalid at that time (e.g. type isn't defined in the policy), then the
> inode SID is left unlabeled and it requires an explicit setxattr(2) to
> correct.
> 
> --
> 
> 
> Stephen Smalley <sds@epoch.ncsc.mil>
> National Security Agency
> 
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.