Re: Fixfiles using new setfiles/restorecon simplification

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 3084 bytes --]

On 02/26/2010 03:49 PM, Stephen Smalley wrote:
> On Fri, 2010-02-26 at 13:59 -0500, Daniel J Walsh wrote:
>    
>> On 02/26/2010 12:56 PM, Stephen Smalley wrote:
>>      
>>> Problems with the new fixfiles logic even with kernels>= 2.6.30:
>>>
>>> - Bind mounts are not excluded (and note that they aren't marked with
>>> bind as an option in /proc/mounts - only in /etc/mtab aka mount output):
>>> # mkdir /foo
>>> # mount -o bind /etc /foo
>>> # grep /foo /proc/mounts
>>> /dev/root /foo ext4 rw,seclabel,relatime,barrier=1,data=ordered 0 0
>>> # grep /foo /etc/mtab
>>> /etc /foo none rw,bind 0 0
>>>
>>> - You are assuming fixed option ordering and that no other options can
>>> appear between "rw" and "seclabel" in your grep pattern for
>>> FILESYSTEMSRW.  As a trivial counterexample, if the user mounts with a
>>> rootcontext= option (override the root directory context, but allow
>>> setting of individual file contexts), it won't match.  If we can assume
>>> that seclabel always follows rw, then you can use grep
>>> 'rw,.*seclabel' /proc/self/mounts.  If they used a regular context=
>>> mount option, then seclabel won't be displayed so that will get
>>> excluded.
>>>
>>> - The definition for FILESYSTEMSRO appears to be wrong.  I think
>>> possibly you want grep 'ro,.*seclabel' there (i.e. filesystems mounted
>>> read-only that support labeling).  Simple test case:
>>> # mount -o remount,ro /boot
>>> # grep 'ro,.*seclabel' /proc/mounts
>>> /dev/sda1 /boot ext3
>>> ro,seclabel,relatime,errors=continue,user_xattr,acl,data=ordered 0 0
>>>
>>>
>>>        
>>
>> How about this script,  It searches mount eliminating context and bind
>> mounts and then
>> searches /proc/self/mounts for seclabel.
>>
>> get_mounts() {
>> FS=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk
>> '/rw/{print $3}';`
>>      
> You can drop the grep -v "context=" if you are relying on seclabel
> in /proc/mounts, as it won't appear if they used a "context=" mount
> (disables setting of security contexts).  Whereas if they used a
> rootcontext= or defcontext= mount just to initialize the root directory
> context (as with /dev in some distributions and /dev/shm) or to define
> the default context if the file lacks an xattr on disk, you still want
> to relabel, so excluding anything with context= would exclude too much.
> That's a bug in the current fixfiles.
>
>    
Dropped
> Also, in the old fixfiles, you used \(rw rather than just rw in the
> pattern so that you would only match on the mount option, not on any
> occurrence of rw in e.g. the name of the device or the directory or the
> filesystem type.
>
>    
Fixed
> Interestingly /dev doesn't appear in mount output aka /etc/mtab but it
> does in /proc/self/mounts.  So at present this won't relabel /dev.
>
>    
Added /dev to list of file context,  Since this is added in 
initrc/dracut, it does not show up in /etc/mtab
>> for i in $FS; do
>>       grep --silent "$i ".*seclabel /proc/self/mounts&&  echo $i
>> done
>> }
>> FILESYSTEMRW=`get_mounts`
>> echo $FILESYSTEMRW
>>      
>    
Updated patch

[-- Attachment #2: fixfiles.patch --]
[-- Type: text/plain, Size: 3359 bytes --]

diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index ae519fc..d694e3c 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -21,6 +21,17 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
 #
+# Get all mounted rw file systems that support seclabel
+#
+get_labeled_mounts() {
+# /dev is not listed in the mountab
+FS="`mount | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/\(rw/{print $3}';` /dev"
+for i in $FS; do 
+    grep --silent "$i ".*seclabel /proc/self/mounts && echo $i
+done
+}
+
+#
 # Set global Variables
 #
 fullFlag=0
@@ -35,9 +46,7 @@ SYSLOGFLAG="-l"
 LOGGER=/usr/sbin/logger
 SETFILES=/sbin/setfiles
 RESTORECON=/sbin/restorecon
-FILESYSTEMSRW=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(rw/{print $3}';`
-FILESYSTEMSRO=`mount | grep -v "context=" | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs ).*\(ro/{print $3}';`
-FILESYSTEMS="$FILESYSTEMSRW $FILESYSTEMSRO"
+FILESYSTEMS=`get_labeled_mounts`
 SELINUXTYPE="targeted"
 if [ -e /etc/selinux/config ]; then
     . /etc/selinux/config
@@ -87,23 +96,10 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
                   esac; \
                fi; \
             done | \
-	while read pattern ; do sh -c "find $pattern \
-		      ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune  -o \
-		      \( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print0"; \
-		      done 2> /dev/null | \
-	 ${RESTORECON} $* -0 -f - 
+		      ${RESTORECON} -f - -R -p  -e /home -e /tmp -r /dev; \
 	rm -f ${TEMPFILE} ${PREFCTEMPFILE}
 fi
 }
-#
-# Log all Read Only file systems 
-#
-LogReadOnly() {
-if [ ! -z "$FILESYSTEMSRO" ]; then
-    logit "Warning: Skipping the following R/O filesystems:"
-    logit "$FILESYSTEMSRO"
-fi
-}
 
 rpmlist() {
 rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' '
@@ -126,18 +122,11 @@ if [ ! -z "$RPMFILES" ]; then
     exit $?
 fi
 if [ ! -z "$FILEPATH" ]; then
-    if [ -x /usr/bin/find ]; then
-	/usr/bin/find "$FILEPATH" \
-	    ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune  -o -print0 | \
-	    ${RESTORECON} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
-    else
-	${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
-    fi
+    ${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
     return
 fi
 [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
-LogReadOnly
-${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
+${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMS} 2>&1 >> $LOGFILE
 rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
 find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
 find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
@@ -146,8 +135,7 @@ exit $?
 
 fullrelabel() {
     logit "Cleaning out /tmp"
-    find /tmp/ -mindepth 1 -print0 | xargs -0 /bin/rm -f
-    LogReadOnly
+    find /tmp/ -mindepth 1 -delete
     restore
 }