Re: refpolicy HEAD, Debian, patch for udev.te

[Martin Orr <martin@martinorr.name>]

[-- Attachment #1: Type: text/plain, Size: 1194 bytes --]

On 01/12/07 23:21, Chris PeBenito wrote:
> On Fri, 2007-11-30 at 17:24 +0000, Martin Orr wrote:
>> On 30/11/07 15:55, Christopher J. PeBenito wrote:
>>> On Fri, 2007-11-30 at 16:30 +0100, Václav Ovsík wrote:
>>>> On Fri, Nov 30, 2007 at 09:38:33AM -0500, Christopher J. PeBenito wrote:
>>>>>> Corresponding code is in udev_node.c, function node_symlink().
>>>>>>     if (strcmp(target, buf) == 0) {
>>>>>> 	    info("preserve already existing symlink '%s' to '%s'", slink,
>>>>>> target);
>>>>>> 	    selinux_setfilecon(slink, NULL, S_IFLNK);
>>>>>> 	    goto exit;
>>>>>>     }
>>>>> I'll add the rule.  Perhaps someone should send up a patch to remove the
>>>>> setfilecon, and update the info message.
> Yes, thats what I was thinkin.  Since the function is node_symlink(),
> I'm guessing there is a similar function for char and block node, etc?
> Those should be checked to make sure they don't do unneeded relabeling
> too.

That's true.  And for char and block nodes, it also does a chmod to reset
the permissions.  Apparently this is intended, because "you can't expect
that the properties of a pre-existing node are correct."

Best wishes,

-- 
Martin Orr


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 252 bytes --]