Setting labels on a disabled SELinux box.

[Daniel J Walsh <dwalsh@redhat.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Currently the kernel is blocking the setting of labels on a disabled
SELinux box.

We have made changes to livecd to be able to build a livecd image on a
disabled SELinux box, but the kernel is preventing the placing of labels.

We want this functionality so that Fedora Build machines can be allowed
to create different kinds of images and do not want to require all
machines to enable SELinux.

Currently these images are being built with SELinux disabled because of
this.

strace shows

lsetxattr("/root/whatever/", "security.selinux",
"system_u:object_r:root_t:s0", 28, 0) = -1 EOPNOTSUPP (Operation not
supported)


eparis says this code is causing the problem.

 static int cap_inode_setsecurity(struct inode *inode, const char *name,
                                  const void *value, size_t size, int flags)
 {
         return -EOPNOTSUPP;
 }

I think we should allow this if you have a capability like sys_admin or
dac_override.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkvNuHcACgkQrlYvE4MpobO6pACgxMKs4oFogWstSyTdzLFsO1Ot
8DkAoKZswtvA17iC0HGDpssyNyUxDjNa
=lGy3
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.