[PATCH] Permit fixfiles to skip configurable directory from relabelling

All of lore.kernel.org
 help / color / mirror / Atom feed

* [PATCH] Permit fixfiles to skip configurable directory from relabelling
@ 2011-04-07 15:47 Elia Pinto
  2011-04-07 15:53 ` Daniel J Walsh
  0 siblings, 1 reply; 7+ messages in thread
From: Elia Pinto @ 2011-04-07 15:47 UTC (permalink / raw)
  To: selinux; +Cc: Elia Pinto, pinto.elia

From: Elia Pinto <yersinia.spiros@gmail.com>

This patch permit fixfiles to check /.autorelabel_excluded
for a list of directories to exclude from relabelling.

Inspired by this blog http://danwalsh.livejournal.com/38157.html.

Signed-off-by: Elia Pinto <yersinia.spiros@gmail.com>
---
 policycoreutils/scripts/fixfiles   |   44 ++++++++++++++++++++++++++++++++---
 policycoreutils/scripts/fixfiles.8 |    2 +
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index ae519fc..ba4d4b1 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -28,6 +28,7 @@ FORCEFLAG=""
 DIRS=""
 RPMILES=""
 LOGFILE=`tty`
+FINDEXCLUDEDPATH=""
 if [ $? != 0 ]; then
     LOGFILE="/dev/null"
 fi
@@ -46,6 +47,24 @@ else
     FC=/etc/security/selinux/file_contexts
 fi
 
+# Add an excluded path for the following
+# find in the function restore, relabel
+
+if [ -e /.autorelabel_excluded ]
+then
+	while read _p
+	do
+          # skip blank line and comment 
+          # skip not absolute path
+          # skip not directory
+          [ -z "${_p}" ] && continue
+          [[ "${_p}" =~ "^[[:blank:]]*#" ]] && continue
+          [[ ! "${_p}" =~ "^/.*" ]] && continue
+          [[ ! -d "${_p}" ]] && continue
+	  FINDEXCLUDEDPATH="${FINDEXCLUDEDPATH} -o -path \"${_p}\""
+	done < /.autorelabel_excluded
+fi
+
 #
 # Log to either syslog or a LOGFILE
 #
@@ -88,7 +107,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
                fi; \
             done | \
 	while read pattern ; do sh -c "find $pattern \
-		      ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune  -o \
+		      ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs ${FINDEXCLUDEDPATH}\) -prune  -o \
 		      \( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print0"; \
 		      done 2> /dev/null | \
 	 ${RESTORECON} $* -0 -f - 
@@ -127,8 +146,9 @@ if [ ! -z "$RPMFILES" ]; then
 fi
 if [ ! -z "$FILEPATH" ]; then
     if [ -x /usr/bin/find ]; then
+        loggit "skipping the directory ${FINDEXCLUDEDPATH//-o -path/} from relabelling"
 	/usr/bin/find "$FILEPATH" \
-	    ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune  -o -print0 | \
+	    ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs ${FINDEXCLUDEDPATH}\) -prune  -o -print0 | \
 	    ${RESTORECON} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
     else
 	${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
@@ -137,8 +157,24 @@ if [ ! -z "$FILEPATH" ]; then
 fi
 [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
 LogReadOnly
-${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
-rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
+# 
+# 
+# "<<none>>" '/md/distro?(/.*)?'
+TEMPFILE=`mktemp ${FC}.XXXXXXXXXX`
+test -z "$TEMPFILE" && exit
+cp -p ${FC} ${TEMPFILE} 
+FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//-o -path/}
+FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//\"/}
+for _p in $FINDEXCLUDEDPATH
+do
+	_p="${_p%/}"
+	_p1="${_p}(/.*)? -- <<none>>"
+	echo "${_p1}" >> $TEMPFILE
+        logit "skipping the directory ${_p} from relabelling"
+done
+
+${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${TEMPFILE} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
+rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFILE
 find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
 find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
 exit $?
diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8
index dfe8aa9..865aab4 100644
--- a/policycoreutils/scripts/fixfiles.8
+++ b/policycoreutils/scripts/fixfiles.8
@@ -29,6 +29,8 @@ new policy, or  just check whether the file contexts are all
 as you expect.  By default it will relabel all mounted ext2, ext3, xfs and 
 jfs file systems as long as they do not have a security context mount 
 option.  You can use the -R flag to use rpmpackages as an alternative.
+The file /.autorelabel_exclude can contain a list of directory path
+that fixfiles don't relabel.
 .P
 .B fixfiles onboot 
 will setup the machine to relabel on the next reboot.
-- 
1.7.2.1.44.g721e7


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH] Permit fixfiles to skip configurable directory from relabelling
  2011-04-07 15:47 [PATCH] Permit fixfiles to skip configurable directory from relabelling Elia Pinto
@ 2011-04-07 15:53 ` Daniel J Walsh
  2011-04-07 16:28   ` Elia Pinto
  2011-04-08 17:14   ` Elia Pinto
  0 siblings, 2 replies; 7+ messages in thread
From: Daniel J Walsh @ 2011-04-07 15:53 UTC (permalink / raw)
  To: Elia Pinto; +Cc: selinux, Elia Pinto, pinto.elia

[-- Attachment #1: Type: text/plain, Size: 5253 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/07/2011 11:47 AM, Elia Pinto wrote:
> From: Elia Pinto <yersinia.spiros@gmail.com>
> 
> This patch permit fixfiles to check /.autorelabel_excluded
> for a list of directories to exclude from relabelling.
> 
> Inspired by this blog http://danwalsh.livejournal.com/38157.html.
> 
> Signed-off-by: Elia Pinto <yersinia.spiros@gmail.com>
> ---
>  policycoreutils/scripts/fixfiles   |   44 ++++++++++++++++++++++++++++++++---
>  policycoreutils/scripts/fixfiles.8 |    2 +
>  2 files changed, 42 insertions(+), 4 deletions(-)
> 
> diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
> index ae519fc..ba4d4b1 100755
> --- a/policycoreutils/scripts/fixfiles
> +++ b/policycoreutils/scripts/fixfiles
> @@ -28,6 +28,7 @@ FORCEFLAG=""
>  DIRS=""
>  RPMILES=""
>  LOGFILE=`tty`
> +FINDEXCLUDEDPATH=""
>  if [ $? != 0 ]; then
>      LOGFILE="/dev/null"
>  fi
> @@ -46,6 +47,24 @@ else
>      FC=/etc/security/selinux/file_contexts
>  fi
>  
> +# Add an excluded path for the following
> +# find in the function restore, relabel
> +
> +if [ -e /.autorelabel_excluded ]
> +then
> +	while read _p
> +	do
> +          # skip blank line and comment 
> +          # skip not absolute path
> +          # skip not directory
> +          [ -z "${_p}" ] && continue
> +          [[ "${_p}" =~ "^[[:blank:]]*#" ]] && continue
> +          [[ ! "${_p}" =~ "^/.*" ]] && continue
> +          [[ ! -d "${_p}" ]] && continue
> +	  FINDEXCLUDEDPATH="${FINDEXCLUDEDPATH} -o -path \"${_p}\""
> +	done < /.autorelabel_excluded
> +fi
> +
>  #
>  # Log to either syslog or a LOGFILE
>  #
> @@ -88,7 +107,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
>                 fi; \
>              done | \
>  	while read pattern ; do sh -c "find $pattern \
> -		      ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune  -o \
> +		      ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs ${FINDEXCLUDEDPATH}\) -prune  -o \
>  		      \( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print0"; \
>  		      done 2> /dev/null | \
>  	 ${RESTORECON} $* -0 -f - 
> @@ -127,8 +146,9 @@ if [ ! -z "$RPMFILES" ]; then
>  fi
>  if [ ! -z "$FILEPATH" ]; then
>      if [ -x /usr/bin/find ]; then
> +        loggit "skipping the directory ${FINDEXCLUDEDPATH//-o -path/} from relabelling"
>  	/usr/bin/find "$FILEPATH" \
> -	    ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune  -o -print0 | \
> +	    ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs ${FINDEXCLUDEDPATH}\) -prune  -o -print0 | \
>  	    ${RESTORECON} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
>      else
>  	${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
> @@ -137,8 +157,24 @@ if [ ! -z "$FILEPATH" ]; then
>  fi
>  [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
>  LogReadOnly
> -${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
> -rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
> +# 
> +# 
> +# "<<none>>" '/md/distro?(/.*)?'
> +TEMPFILE=`mktemp ${FC}.XXXXXXXXXX`
> +test -z "$TEMPFILE" && exit
> +cp -p ${FC} ${TEMPFILE} 
> +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//-o -path/}
> +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//\"/}
> +for _p in $FINDEXCLUDEDPATH
> +do
> +	_p="${_p%/}"
> +	_p1="${_p}(/.*)? -- <<none>>"
> +	echo "${_p1}" >> $TEMPFILE
> +        logit "skipping the directory ${_p} from relabelling"
> +done
> +
> +${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${TEMPFILE} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
> +rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFILE
>  find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
>  find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
>  exit $?
> diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8
> index dfe8aa9..865aab4 100644
> --- a/policycoreutils/scripts/fixfiles.8
> +++ b/policycoreutils/scripts/fixfiles.8
> @@ -29,6 +29,8 @@ new policy, or  just check whether the file contexts are all
>  as you expect.  By default it will relabel all mounted ext2, ext3, xfs and 
>  jfs file systems as long as they do not have a security context mount 
>  option.  You can use the -R flag to use rpmpackages as an alternative.
> +The file /.autorelabel_exclude can contain a list of directory path
> +that fixfiles don't relabel.
>  .P
>  .B fixfiles onboot 
>  will setup the machine to relabel on the next reboot.

This file should not be in /, I think it would be better to put it in
/etc/selinux

I have attached the current Fedora fixfiles.  Which has some similar fixes.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2d3hQACgkQrlYvE4MpobNgYACg4hHDc5kgHLVPdfjb2KmytGNY
rggAn0INl+1Mf5odXoUq5rJQR6FT/RzD
=KAVX
-----END PGP SIGNATURE-----

[-- Attachment #2: fixfiles --]
[-- Type: text/plain, Size: 6203 bytes --]

#!/bin/bash
# fixfiles
#
# Script to restore labels on a SELinux box
#
# Copyright (C) 2004-2009 Red Hat, Inc.
# Authors: Dan Walsh <dwalsh@redhat.com>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

#
# Get all mounted rw file systems that support seclabel
#
get_labeled_mounts() {
# /dev is not listed in the mountab
FS="`mount | egrep -v '\((|.*,)bind(,.*|)\)' | awk '/\(rw/{print $3}';` /dev"
for i in $FS; do 
    grep --silent "$i ".*seclabel /proc/self/mounts && echo $i
done
}

exclude_dirs() {
    exclude= 
    for i in /var/lib/BackupPC /home /tmp /dev; do 
        [ -e $i ]  && exclude="$exclude -e $i"; 
    done 
    echo "$exclude"
}

#
# Set global Variables
#
fullFlag=0
FORCEFLAG=""
DIRS=""
RPMILES=""
LOGFILE=`tty`
if [ $? != 0 ]; then
    LOGFILE="/dev/null"
fi
SYSLOGFLAG="-l"
LOGGER=/usr/sbin/logger
SETFILES=/sbin/setfiles
RESTORECON=/sbin/restorecon
FILESYSTEMS=`get_labeled_mounts`
SELINUXTYPE="targeted"
if [ -e /etc/selinux/config ]; then
    . /etc/selinux/config
    FC=/etc/selinux/${SELINUXTYPE}/contexts/files/file_contexts 
else
    FC=/etc/security/selinux/file_contexts
fi

#
# Log to either syslog or a LOGFILE
#
logit () {
if [ -n $LOGFILE ]; then
    echo $1 >> $LOGFILE
fi
}
#
# Compare PREVious File Context to currently installed File Context and 
# run restorecon on all files affected by the differences.
#
diff_filecontext() {
if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
	TEMPFILE=`mktemp ${FC}.XXXXXXXXXX`
	test -z "$TEMPFILE" && exit
	PREFCTEMPFILE=`mktemp ${PREFC}.XXXXXXXXXX`
	sed -r -e 's,:s0, ,g' $PREFC | sort -u > ${PREFCTEMPFILE}
	sed -r -e 's,:s0, ,g' $FC | sort -u | \
	/usr/bin/diff -b ${PREFCTEMPFILE} - | \
	    grep '^[<>]'|cut -c3-| grep ^/ | \
	    egrep -v '(^/home|^/root|^/tmp|^/dev)' |\
	sed -r -e 's,[[:blank:]].*,,g' \
               -e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \
	       -e 's|([/[:alnum:]])\?|{\1,}|g' \
               -e 's|\?.*|*|g' \
	       -e 's|\(.*|*|g' \
	       -e 's|\[.*|*|g' \
               -e 's|\.\*.*|*|g' \
               -e 's|\.\+.*|*|g' | \
	    # These two sorts need to be separate commands \
	sort -u | \
	sort -d | \
        while read pattern ; \
	    do if ! echo "$pattern" | grep -q -f ${TEMPFILE} 2>/dev/null; then \
                  echo "$pattern"; \
                  case "$pattern" in *"*") \
	               echo "$pattern" | sed -e 's,^,^,' -e 's,\*$,,g' >> ${TEMPFILE};;  
                  esac; \
               fi; \
            done | \
		      ${RESTORECON} -f - -R -p `exclude_dirs`; \
	rm -f ${TEMPFILE} ${PREFCTEMPFILE}
fi
}

rpmlist() {
rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' '
[ ${PIPESTATUS[0]} != 0 ] && echo "$1 not found" >/dev/stderr
}

# 
# restore
# if called with -n will only check file context
#
restore () {
if [ ! -z "$PREFC" ]; then
    diff_filecontext $*
    exit $?
fi
if [ ! -z "$RPMFILES" ]; then
    for i in `echo "$RPMFILES" | sed 's/,/ /g'`; do
	rpmlist $i | ${RESTORECON} ${FORCEFLAG} $* -R -i -f - 2>&1 | cat >> $LOGFILE
    done
    exit $?
fi
if [ ! -z "$FILEPATH" ]; then
    ${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 | cat >> $LOGFILE
    return
fi
[ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMS} 2>&1 | cat >> $LOGFILE
rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
exit $?
}

fullrelabel() {
    logit "Cleaning out /tmp"
    find /tmp/ -mindepth 1 -delete
    restore
}

relabel() {
    if [ ! -z "$RPMFILES" ]; then
	restore 
    fi

    if [ $fullFlag == 1  ]; then
	fullrelabel
    fi

    echo -n "
    Files in the /tmp directory may be labeled incorrectly, this command 
    can remove all files in /tmp.  If you choose to remove files from /tmp, 
    a reboot will be required after completion.
    
    Do you wish to clean out the /tmp directory [N]? "
    read answer
    if [ "$answer" = y -o  "$answer" = Y ]; then 
	fullrelabel
    else
	restore
    fi
}

process() {
#
# Make sure they specified one of the three valid commands
#
case "$1" in
    restore) restore -p ;;
    check) restore -n -v;;
    verify) restore -n -o -;;
    relabel) relabel;;
    onboot)
	touch /.autorelabel
	echo "System will relabel on next boot"
	;;
    *)
    usage
    exit 1
esac
}
usage() {
      	echo $"""
Usage: $0 [-F] [-l logfile ] { check | restore| [-f] relabel | verify } [[dir/file] ... ] 
or
Usage: $0 [-F] -R rpmpackage[,rpmpackage...] [-l logfile ] { check | restore | verify }
or
Usage: $0 [-F] -C PREVIOUS_FILECONTEXT { check | restore | verify }
or
Usage: $0 onboot
"""
}

if [ $# = 0 ]; then
	usage
	exit 1
fi

# See how we were called.
while getopts "C:FfR:l:" i; do
    case "$i" in
	f)
		fullFlag=1
		;;
        R)
		RPMFILES=$OPTARG
		;;
        l)
		LOGFILE=$OPTARG
		;;
        C)
		PREFC=$OPTARG
		;;
	F)
		FORCEFLAG="-F"
		;;
	*)
	    usage
	    exit 1
esac
done

# Move out processed options from arguments
shift $(( OPTIND - 1 ))

# Check for the command
command=$1
if [ -z $command ]; then
    usage
fi

# Move out command from arguments
shift

#
# check if they specified both DIRS and RPMFILES
#

if [ ! -z "$RPMFILES" ]; then
    process $command
    if [ $# -gt 0 ]; then
	    usage
    fi
else
    if [ -z "$1" ]; then
	process $command
    else
	while [ -n "$1" ]; do 
	    FILEPATH=$1
	    process $command 
	    shift
    	done
    fi
fi
exit $?

[-- Attachment #3: fixfiles.sig --]
[-- Type: application/pgp-signature, Size: 72 bytes --]

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] Permit fixfiles to skip configurable directory from relabelling
  2011-04-07 15:53 ` Daniel J Walsh
@ 2011-04-07 16:28   ` Elia Pinto
  2011-04-08 17:14   ` Elia Pinto
  1 sibling, 0 replies; 7+ messages in thread
From: Elia Pinto @ 2011-04-07 16:28 UTC (permalink / raw)
  To: Daniel J Walsh, selinux, Elia Pinto, pinto.elia

I had the same dubt. I haven't noticed that fc15 had Similar fix. So,
The patch is useless. Thanks for the fast review. Regards

2011/4/7, Daniel J Walsh <dwalsh@redhat.com>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 04/07/2011 11:47 AM, Elia Pinto wrote:
>> From: Elia Pinto <yersinia.spiros@gmail.com>
>>
>> This patch permit fixfiles to check /.autorelabel_excluded
>> for a list of directories to exclude from relabelling.
>>
>> Inspired by this blog http://danwalsh.livejournal.com/38157.html.
>>
>> Signed-off-by: Elia Pinto <yersinia.spiros@gmail.com>
>> ---
>>  policycoreutils/scripts/fixfiles   |   44
>> ++++++++++++++++++++++++++++++++---
>>  policycoreutils/scripts/fixfiles.8 |    2 +
>>  2 files changed, 42 insertions(+), 4 deletions(-)
>>
>> diff --git a/policycoreutils/scripts/fixfiles
>> b/policycoreutils/scripts/fixfiles
>> index ae519fc..ba4d4b1 100755
>> --- a/policycoreutils/scripts/fixfiles
>> +++ b/policycoreutils/scripts/fixfiles
>> @@ -28,6 +28,7 @@ FORCEFLAG=""
>>  DIRS=""
>>  RPMILES=""
>>  LOGFILE=`tty`
>> +FINDEXCLUDEDPATH=""
>>  if [ $? != 0 ]; then
>>      LOGFILE="/dev/null"
>>  fi
>> @@ -46,6 +47,24 @@ else
>>      FC=/etc/security/selinux/file_contexts
>>  fi
>>
>> +# Add an excluded path for the following
>> +# find in the function restore, relabel
>> +
>> +if [ -e /.autorelabel_excluded ]
>> +then
>> +	while read _p
>> +	do
>> +          # skip blank line and comment
>> +          # skip not absolute path
>> +          # skip not directory
>> +          [ -z "${_p}" ] && continue
>> +          [[ "${_p}" =~ "^[[:blank:]]*#" ]] && continue
>> +          [[ ! "${_p}" =~ "^/.*" ]] && continue
>> +          [[ ! -d "${_p}" ]] && continue
>> +	  FINDEXCLUDEDPATH="${FINDEXCLUDEDPATH} -o -path \"${_p}\""
>> +	done < /.autorelabel_excluded
>> +fi
>> +
>>  #
>>  # Log to either syslog or a LOGFILE
>>  #
>> @@ -88,7 +107,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
>>                 fi; \
>>              done | \
>>  	while read pattern ; do sh -c "find $pattern \
>> -		      ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype
>> ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \)
>> -prune  -o \
>> +		      ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype
>> ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs
>> ${FINDEXCLUDEDPATH}\) -prune  -o \
>>  		      \( -wholename /home -o -wholename /root -o -wholename /tmp
>> -wholename /dev \) -prune -o -print0"; \
>>  		      done 2> /dev/null | \
>>  	 ${RESTORECON} $* -0 -f -
>> @@ -127,8 +146,9 @@ if [ ! -z "$RPMFILES" ]; then
>>  fi
>>  if [ ! -z "$FILEPATH" ]; then
>>      if [ -x /usr/bin/find ]; then
>> +        loggit "skipping the directory ${FINDEXCLUDEDPATH//-o -path/}
>> from relabelling"
>>  	/usr/bin/find "$FILEPATH" \
>> -	    ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev
>> -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune
>> -o -print0 | \
>> +	    ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev
>> -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs
>> ${FINDEXCLUDEDPATH}\) -prune  -o -print0 | \
>>  	    ${RESTORECON} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
>>      else
>>  	${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
>> @@ -137,8 +157,24 @@ if [ ! -z "$FILEPATH" ]; then
>>  fi
>>  [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
>>  LogReadOnly
>> -${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1
>> >> $LOGFILE
>> -rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
>> +#
>> +#
>> +# "<<none>>" '/md/distro?(/.*)?'
>> +TEMPFILE=`mktemp ${FC}.XXXXXXXXXX`
>> +test -z "$TEMPFILE" && exit
>> +cp -p ${FC} ${TEMPFILE}
>> +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//-o -path/}
>> +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//\"/}
>> +for _p in $FINDEXCLUDEDPATH
>> +do
>> +	_p="${_p%/}"
>> +	_p1="${_p}(/.*)? -- <<none>>"
>> +	echo "${_p1}" >> $TEMPFILE
>> +        logit "skipping the directory ${_p} from relabelling"
>> +done
>> +
>> +${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${TEMPFILE} ${FILESYSTEMSRW}
>> 2>&1 >> $LOGFILE
>> +rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFILE
>>  find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec
>> chcon -t tmp_t {} \;
>>  find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \)
>> -exec chcon -t tmp_t {} \;
>>  exit $?
>> diff --git a/policycoreutils/scripts/fixfiles.8
>> b/policycoreutils/scripts/fixfiles.8
>> index dfe8aa9..865aab4 100644
>> --- a/policycoreutils/scripts/fixfiles.8
>> +++ b/policycoreutils/scripts/fixfiles.8
>> @@ -29,6 +29,8 @@ new policy, or  just check whether the file contexts are
>> all
>>  as you expect.  By default it will relabel all mounted ext2, ext3, xfs
>> and
>>  jfs file systems as long as they do not have a security context mount
>>  option.  You can use the -R flag to use rpmpackages as an alternative.
>> +The file /.autorelabel_exclude can contain a list of directory path
>> +that fixfiles don't relabel.
>>  .P
>>  .B fixfiles onboot
>>  will setup the machine to relabel on the next reboot.
>
> This file should not be in /, I think it would be better to put it in
> /etc/selinux
>
> I have attached the current Fedora fixfiles.  Which has some similar fixes.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk2d3hQACgkQrlYvE4MpobNgYACg4hHDc5kgHLVPdfjb2KmytGNY
> rggAn0INl+1Mf5odXoUq5rJQR6FT/RzD
> =KAVX
> -----END PGP SIGNATURE-----
>

-- 
Inviato dal mio dispositivo mobile

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH] Permit fixfiles to skip configurable directory from relabelling
  2011-04-07 15:53 ` Daniel J Walsh
  2011-04-07 16:28   ` Elia Pinto
@ 2011-04-08 17:14   ` Elia Pinto
  2011-04-11 18:35     ` Daniel J Walsh
  1 sibling, 1 reply; 7+ messages in thread
From: Elia Pinto @ 2011-04-08 17:14 UTC (permalink / raw)
  To: Daniel J Walsh; +Cc: selinux


[-- Attachment #1.1: Type: text/plain, Size: 6001 bytes --]

On Thu, Apr 7, 2011 at 5:53 PM, Daniel J Walsh <dwalsh@redhat.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 04/07/2011 11:47 AM, Elia Pinto wrote:
> > From: Elia Pinto <yersinia.spiros@gmail.com>
> >
> > This patch permit fixfiles to check /.autorelabel_excluded
> > for a list of directories to exclude from relabelling.
> >
> > Inspired by this blog http://danwalsh.livejournal.com/38157.html.
> >
> > Signed-off-by: Elia Pinto <yersinia.spiros@gmail.com>
> > ---
> >  policycoreutils/scripts/fixfiles   |   44
> ++++++++++++++++++++++++++++++++---
> >  policycoreutils/scripts/fixfiles.8 |    2 +
> >  2 files changed, 42 insertions(+), 4 deletions(-)
> >
> > diff --git a/policycoreutils/scripts/fixfiles
> b/policycoreutils/scripts/fixfiles
> > index ae519fc..ba4d4b1 100755
> > --- a/policycoreutils/scripts/fixfiles
> > +++ b/policycoreutils/scripts/fixfiles
> > @@ -28,6 +28,7 @@ FORCEFLAG=""
> >  DIRS=""
> >  RPMILES=""
> >  LOGFILE=`tty`
> > +FINDEXCLUDEDPATH=""
> >  if [ $? != 0 ]; then
> >      LOGFILE="/dev/null"
> >  fi
> > @@ -46,6 +47,24 @@ else
> >      FC=/etc/security/selinux/file_contexts
> >  fi
> >
> > +# Add an excluded path for the following
> > +# find in the function restore, relabel
> > +
> > +if [ -e /.autorelabel_excluded ]
> > +then
> > +     while read _p
> > +     do
> > +          # skip blank line and comment
> > +          # skip not absolute path
> > +          # skip not directory
> > +          [ -z "${_p}" ] && continue
> > +          [[ "${_p}" =~ "^[[:blank:]]*#" ]] && continue
> > +          [[ ! "${_p}" =~ "^/.*" ]] && continue
> > +          [[ ! -d "${_p}" ]] && continue
> > +       FINDEXCLUDEDPATH="${FINDEXCLUDEDPATH} -o -path \"${_p}\""
> > +     done < /.autorelabel_excluded
> > +fi
> > +
> >  #
> >  # Log to either syslog or a LOGFILE
> >  #
> > @@ -88,7 +107,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
> >                 fi; \
> >              done | \
> >       while read pattern ; do sh -c "find $pattern \
> > -                   ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o
> -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype
> btrfs \) -prune  -o \
> > +                   ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o
> -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype
> btrfs ${FINDEXCLUDEDPATH}\) -prune  -o \
> >                     \( -wholename /home -o -wholename /root -o -wholename
> /tmp -wholename /dev \) -prune -o -print0"; \
> >                     done 2> /dev/null | \
> >        ${RESTORECON} $* -0 -f -
> > @@ -127,8 +146,9 @@ if [ ! -z "$RPMFILES" ]; then
> >  fi
> >  if [ ! -z "$FILEPATH" ]; then
> >      if [ -x /usr/bin/find ]; then
> > +        loggit "skipping the directory ${FINDEXCLUDEDPATH//-o -path/}
> from relabelling"
> >       /usr/bin/find "$FILEPATH" \
> > -         ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype
> ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \)
> -prune  -o -print0 | \
> > +         ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype
> ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs
> ${FINDEXCLUDEDPATH}\) -prune  -o -print0 | \
> >           ${RESTORECON} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
> >      else
> >       ${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
> > @@ -137,8 +157,24 @@ if [ ! -z "$FILEPATH" ]; then
> >  fi
> >  [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
> >  LogReadOnly
> > -${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1
> >> $LOGFILE
> > -rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
> > +#
> > +#
> > +# "<<none>>" '/md/distro?(/.*)?'
> > +TEMPFILE=`mktemp ${FC}.XXXXXXXXXX`
> > +test -z "$TEMPFILE" && exit
> > +cp -p ${FC} ${TEMPFILE}
> > +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//-o -path/}
> > +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//\"/}
> > +for _p in $FINDEXCLUDEDPATH
> > +do
> > +     _p="${_p%/}"
> > +     _p1="${_p}(/.*)? -- <<none>>"
> > +     echo "${_p1}" >> $TEMPFILE
> > +        logit "skipping the directory ${_p} from relabelling"
> > +done
> > +
> > +${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${TEMPFILE}
> ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
> > +rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFILE
> >  find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec
> chcon -t tmp_t {} \;
> >  find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \)
> -exec chcon -t tmp_t {} \;
> >  exit $?
> > diff --git a/policycoreutils/scripts/fixfiles.8
> b/policycoreutils/scripts/fixfiles.8
> > index dfe8aa9..865aab4 100644
> > --- a/policycoreutils/scripts/fixfiles.8
> > +++ b/policycoreutils/scripts/fixfiles.8
> > @@ -29,6 +29,8 @@ new policy, or  just check whether the file contexts
> are all
> >  as you expect.  By default it will relabel all mounted ext2, ext3, xfs
> and
> >  jfs file systems as long as they do not have a security context mount
> >  option.  You can use the -R flag to use rpmpackages as an alternative.
> > +The file /.autorelabel_exclude can contain a list of directory path
> > +that fixfiles don't relabel.
> >  .P
> >  .B fixfiles onboot
> >  will setup the machine to relabel on the next reboot.
>
> This file should not be in /, I think it would be better to put it in
> /etc/selinux
>
> I have attached the current Fedora fixfiles.  Which has some similar fixes.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAk2d3hQACgkQrlYvE4MpobNgYACg4hHDc5kgHLVPdfjb2KmytGNY
> rggAn0INl+1Mf5odXoUq5rJQR6FT/RzD
> =KAVX
> -----END PGP SIGNATURE-----
>
I include two simple patch (-p1 were fixfiles and fixfiles.8 live) for
adding a conf file that contain the directory to skip for relabel. I have
followed your advice for the conf path.
Developed with the version contained in
policycoreutils-2.0.85-27.fc15.x86_64 (fc15 last update).

Best Regards

[-- Attachment #1.2: Type: text/html, Size: 7663 bytes --]

[-- Attachment #2: fixfiles.patch --]
[-- Type: application/octet-stream, Size: 2109 bytes --]

diff --git a/fixfiles b/fixfiles
index 0890811..7d21ea3 100755
--- a/fixfiles
+++ b/fixfiles
@@ -30,12 +30,31 @@ for i in $FS; do
     grep --silent "$i ".*seclabel /proc/self/mounts && echo $i
 done
 }
-
+exclude_dirs_from_relabelling() {
+    exclude_from_relabelling= 
+    if [ -e /etc/selinux/fixfiles_exclude_dirs ]
+    then
+        while read i
+        do
+          # skip blank line and comment
+          # skip not absolute path
+          # skip not directory
+          [ -z "${i}" ] && continue
+          [[ "${i}" =~ "^[[:blank:]]*#" ]] && continue
+          [[ ! "${i}" =~ ^/.* ]] && continue
+          [[ ! -d "${i}" ]] && continue
+          exclude_from_relabelling="$exclude_from_relabelling -e $i"
+          logit "skipping the directory $i from relabelling"
+        done < /etc/selinux/fixfiles_exclude_dirs
+    fi
+    echo "$exclude_from_relabelling"
+}
 exclude_dirs() {
     exclude= 
     for i in /var/lib/BackupPC /home /tmp /dev; do 
         [ -e $i ]  && exclude="$exclude -e $i"; 
     done 
+    exclude="$exclude `exclude_dirs_from_relabelling`"
     echo "$exclude"
 }
 
@@ -134,8 +153,25 @@ if [ ! -z "$FILEPATH" ]; then
     return
 fi
 [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
+#
+exclude_dirs="`exclude_dirs_from_relabelling`"
+if [ -n "${exclude_dirs}" ] 
+then 
+	TEMPFCFILE=`mktemp ${FC}.XXXXXXXXXX`
+	test -z "$TEMPFCFILE" && exit
+	/bin/cp -p ${FC} ${TEMPFCFILE} &>/dev/null || exit 
+	exclude_dirs=${exclude_dirs//-e/}
+	for p in ${exclude_dirs}
+	do
+       	 p="${p%/}"
+       	 p1="${p}(/.*)? -- <<none>>"
+       	 echo "${p1}" >> $TEMPFCFILE
+       	 logit "skipping the directory ${p} from relabelling"
+	done
+FC=$TEMPFCFILE
+fi
 ${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMS} 2>&1 | cat >> $LOGFILE
-rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
+rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFCFILE
 find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
 find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
 exit $?

[-- Attachment #3: fixfiles.8.patch --]
[-- Type: application/octet-stream, Size: 588 bytes --]

diff --git a/fixfiles.8 b/fixfiles.8
index dfe8aa9..0b4cbaa 100644
--- a/fixfiles.8
+++ b/fixfiles.8
@@ -29,6 +29,8 @@ new policy, or  just check whether the file contexts are all
 as you expect.  By default it will relabel all mounted ext2, ext3, xfs and 
 jfs file systems as long as they do not have a security context mount 
 option.  You can use the -R flag to use rpmpackages as an alternative.
+The file /etc/selinux/fixfiles_exclude_dirs can contain a list of directories
+excluded from relabelling.
 .P
 .B fixfiles onboot 
 will setup the machine to relabel on the next reboot.

^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH] Permit fixfiles to skip configurable directory from relabelling
  2011-04-08 17:14   ` Elia Pinto
@ 2011-04-11 18:35     ` Daniel J Walsh
  0 siblings, 0 replies; 7+ messages in thread
From: Daniel J Walsh @ 2011-04-11 18:35 UTC (permalink / raw)
  To: Elia Pinto; +Cc: selinux

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/08/2011 01:14 PM, Elia Pinto wrote:
> On Thu, Apr 7, 2011 at 5:53 PM, Daniel J Walsh <dwalsh@redhat.com
> <mailto:dwalsh@redhat.com>> wrote:
> 
> On 04/07/2011 11:47 AM, Elia Pinto wrote:
>> From: Elia Pinto <yersinia.spiros@gmail.com
> <mailto:yersinia.spiros@gmail.com>>
> 
>> This patch permit fixfiles to check /.autorelabel_excluded
>> for a list of directories to exclude from relabelling.
> 
>> Inspired by this blog http://danwalsh.livejournal.com/38157.html.
> 
>> Signed-off-by: Elia Pinto <yersinia.spiros@gmail.com
> <mailto:yersinia.spiros@gmail.com>>
>> ---
>>  policycoreutils/scripts/fixfiles   |   44
> ++++++++++++++++++++++++++++++++---
>>  policycoreutils/scripts/fixfiles.8 |    2 +
>>  2 files changed, 42 insertions(+), 4 deletions(-)
> 
>> diff --git a/policycoreutils/scripts/fixfiles
> b/policycoreutils/scripts/fixfiles
>> index ae519fc..ba4d4b1 100755
>> --- a/policycoreutils/scripts/fixfiles
>> +++ b/policycoreutils/scripts/fixfiles
>> @@ -28,6 +28,7 @@ FORCEFLAG=""
>>  DIRS=""
>>  RPMILES=""
>>  LOGFILE=`tty`
>> +FINDEXCLUDEDPATH=""
>>  if [ $? != 0 ]; then
>>      LOGFILE="/dev/null"
>>  fi
>> @@ -46,6 +47,24 @@ else
>>      FC=/etc/security/selinux/file_contexts
>>  fi
> 
>> +# Add an excluded path for the following
>> +# find in the function restore, relabel
>> +
>> +if [ -e /.autorelabel_excluded ]
>> +then
>> +     while read _p
>> +     do
>> +          # skip blank line and comment
>> +          # skip not absolute path
>> +          # skip not directory
>> +          [ -z "${_p}" ] && continue
>> +          [[ "${_p}" =~ "^[[:blank:]]*#" ]] && continue
>> +          [[ ! "${_p}" =~ "^/.*" ]] && continue
>> +          [[ ! -d "${_p}" ]] && continue
>> +       FINDEXCLUDEDPATH="${FINDEXCLUDEDPATH} -o -path \"${_p}\""
>> +     done < /.autorelabel_excluded
>> +fi
>> +
>>  #
>>  # Log to either syslog or a LOGFILE
>>  #
>> @@ -88,7 +107,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
>>                 fi; \
>>              done | \
>>       while read pattern ; do sh -c "find $pattern \
>> -                   ! \( -fstype ext2 -o -fstype ext3 -o -fstype
> ext4 -o -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype
> xfs -o -fstype btrfs \) -prune  -o \
>> +                   ! \( -fstype ext2 -o -fstype ext3 -o -fstype
> ext4 -o -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype
> xfs -o -fstype btrfs ${FINDEXCLUDEDPATH}\) -prune  -o \
>>                     \( -wholename /home -o -wholename /root -o
> -wholename /tmp -wholename /dev \) -prune -o -print0"; \
>>                     done 2> /dev/null | \
>>        ${RESTORECON} $* -0 -f -
>> @@ -127,8 +146,9 @@ if [ ! -z "$RPMFILES" ]; then
>>  fi
>>  if [ ! -z "$FILEPATH" ]; then
>>      if [ -x /usr/bin/find ]; then
>> +        loggit "skipping the directory ${FINDEXCLUDEDPATH//-o
> -path/} from relabelling"
>>       /usr/bin/find "$FILEPATH" \
>> -         ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o
> -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o
> -fstype btrfs \) -prune  -o -print0 | \
>> +         ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o
> -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o
> -fstype btrfs ${FINDEXCLUDEDPATH}\) -prune  -o -print0 | \
>>           ${RESTORECON} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
>>      else
>>       ${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
>> @@ -137,8 +157,24 @@ if [ ! -z "$FILEPATH" ]; then
>>  fi
>>  [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
>>  LogReadOnly
>> -${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC}
> ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
>> -rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
>> +#
>> +#
>> +# "<<none>>" '/md/distro?(/.*)?'
>> +TEMPFILE=`mktemp ${FC}.XXXXXXXXXX`
>> +test -z "$TEMPFILE" && exit
>> +cp -p ${FC} ${TEMPFILE}
>> +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//-o -path/}
>> +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//\"/}
>> +for _p in $FINDEXCLUDEDPATH
>> +do
>> +     _p="${_p%/}"
>> +     _p1="${_p}(/.*)? -- <<none>>"
>> +     echo "${_p1}" >> $TEMPFILE
>> +        logit "skipping the directory ${_p} from relabelling"
>> +done
>> +
>> +${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${TEMPFILE}
> ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
>> +rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFILE
>>  find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \)
> -exec chcon -t tmp_t {} \;
>>  find /var/tmp \( -context "*:file_t*" -o -context
> "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
>>  exit $?
>> diff --git a/policycoreutils/scripts/fixfiles.8
> b/policycoreutils/scripts/fixfiles.8
>> index dfe8aa9..865aab4 100644
>> --- a/policycoreutils/scripts/fixfiles.8
>> +++ b/policycoreutils/scripts/fixfiles.8
>> @@ -29,6 +29,8 @@ new policy, or  just check whether the file
> contexts are all
>>  as you expect.  By default it will relabel all mounted ext2,
> ext3, xfs and
>>  jfs file systems as long as they do not have a security context mount
>>  option.  You can use the -R flag to use rpmpackages as an
> alternative.
>> +The file /.autorelabel_exclude can contain a list of directory path
>> +that fixfiles don't relabel.
>>  .P
>>  .B fixfiles onboot
>>  will setup the machine to relabel on the next reboot.
> 
> This file should not be in /, I think it would be better to put it in
> /etc/selinux
> 
> I have attached the current Fedora fixfiles.  Which has some similar
> fixes.

Your patch will be in policycoreutils-2.0.85-30.fc15
> I include two simple patch (-p1 were fixfiles and fixfiles.8 live) for
> adding a conf file that contain the directory to skip for relabel. I
> have followed your advice for the conf path.
> Developed with the version contained in
> policycoreutils-2.0.85-27.fc15.x86_64 (fc15 last update).

> Best Regards

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2jSgoACgkQrlYvE4MpobPxgQCcCT4QLEBKxDEPSp2RBCMAZLa5
+lkAoKtkx0ZF4z6omr657KoTYqmFwCpF
=C7Ee
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH] Permit fixfiles to skip configurable directory from relabelling
@ 2011-04-07 15:40 Elia Pinto
  2011-04-07 15:46 ` Elia Pinto
  0 siblings, 1 reply; 7+ messages in thread
From: Elia Pinto @ 2011-04-07 15:40 UTC (permalink / raw)
  To: selinux; +Cc: Elia Pinto, pinto.elia

From: Elia Pinto <yersinia.spiros@gmail.com>

This patch permit fixfiles to check /.autorelabel_excluded
for a list of directories to exclude from relabelling.

Inspired by this blog http://danwalsh.livejournal.com/38157.html.

Signed-off-by: Elia Pinto <yersinia.spiros@gmail.com>
---
 policycoreutils/scripts/fixfiles   |   45 ++++++++++++++++++++++++++++++++---
 policycoreutils/scripts/fixfiles.8 |    2 +
 2 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index ae519fc..2a39d74 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -28,6 +28,7 @@ FORCEFLAG=""
 DIRS=""
 RPMILES=""
 LOGFILE=`tty`
+FINDEXCLUDEDPATH=""
 if [ $? != 0 ]; then
     LOGFILE="/dev/null"
 fi
@@ -46,6 +47,24 @@ else
     FC=/etc/security/selinux/file_contexts
 fi
 
+# Add an excluded path for the following
+# find in the function restore, relabel
+
+if [ -e /.autorelabel_excluded ]
+then
+	while read _p
+	do
+          # skip blank line and comment 
+          # skip not absolute path
+          # skip not directory
+          [ -z "${_p}" ] && continue
+          [[ "${_p}" =~ "^[[:blank:]]*#" ]] && continue
+          [[ ! "${_p}" =~ "^/.*" ]] && continue
+          [[ ! -d "${_p}" ]] && continue
+	  FINDEXCLUDEDPATH="${FINDEXCLUDEDPATH} -o -path \"${_p}\""
+	done < /.autorelabel_excluded
+fi
+
 #
 # Log to either syslog or a LOGFILE
 #
@@ -88,7 +107,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
                fi; \
             done | \
 	while read pattern ; do sh -c "find $pattern \
-		      ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune  -o \
+		      ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs ${FINDEXCLUDEDPATH}\) -prune  -o \
 		      \( -wholename /home -o -wholename /root -o -wholename /tmp -wholename /dev \) -prune -o -print0"; \
 		      done 2> /dev/null | \
 	 ${RESTORECON} $* -0 -f - 
@@ -115,6 +134,7 @@ rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" | grep '^0 ' | cut -f2- -d ' '
 # if called with -n will only check file context
 #
 restore () {
+set -x
 if [ ! -z "$PREFC" ]; then
     diff_filecontext $*
     exit $?
@@ -127,8 +147,9 @@ if [ ! -z "$RPMFILES" ]; then
 fi
 if [ ! -z "$FILEPATH" ]; then
     if [ -x /usr/bin/find ]; then
+        loggit "skipping the directory ${FINDEXCLUDEDPATH//-o -path/} from relabelling"
 	/usr/bin/find "$FILEPATH" \
-	    ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \) -prune  -o -print0 | \
+	    ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs ${FINDEXCLUDEDPATH}\) -prune  -o -print0 | \
 	    ${RESTORECON} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
     else
 	${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
@@ -137,8 +158,24 @@ if [ ! -z "$FILEPATH" ]; then
 fi
 [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
 LogReadOnly
-${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
-rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
+# 
+# 
+# "<<none>>" '/md/distro?(/.*)?'
+TEMPFILE=`mktemp ${FC}.XXXXXXXXXX`
+test -z "$TEMPFILE" && exit
+cp -p ${FC} ${TEMPFILE} 
+FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//-o -path/}
+FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//\"/}
+for _p in $FINDEXCLUDEDPATH
+do
+	_p="${_p%/}"
+	_p1="${_p}(/.*)? -- <<none>>"
+	echo "${_p1}" >> $TEMPFILE
+        logit "skipping the directory ${_p} from relabelling"
+done
+
+${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${TEMPFILE} ${FILESYSTEMSRW} 2>&1 >> $LOGFILE
+rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFILE
 find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
 find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
 exit $?
diff --git a/policycoreutils/scripts/fixfiles.8 b/policycoreutils/scripts/fixfiles.8
index dfe8aa9..865aab4 100644
--- a/policycoreutils/scripts/fixfiles.8
+++ b/policycoreutils/scripts/fixfiles.8
@@ -29,6 +29,8 @@ new policy, or  just check whether the file contexts are all
 as you expect.  By default it will relabel all mounted ext2, ext3, xfs and 
 jfs file systems as long as they do not have a security context mount 
 option.  You can use the -R flag to use rpmpackages as an alternative.
+The file /.autorelabel_exclude can contain a list of directory path
+that fixfiles don't relabel.
 .P
 .B fixfiles onboot 
 will setup the machine to relabel on the next reboot.
-- 
1.7.2.1.44.g721e7


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH] Permit fixfiles to skip configurable directory from relabelling
  2011-04-07 15:40 Elia Pinto
@ 2011-04-07 15:46 ` Elia Pinto
  0 siblings, 0 replies; 7+ messages in thread
From: Elia Pinto @ 2011-04-07 15:46 UTC (permalink / raw)
  To: selinux; +Cc: Elia Pinto, pinto.elia

[-- Attachment #1: Type: text/plain, Size: 5298 bytes --]

Sorry there was a typo, i will repost shortly. Please ignore this patch

2011/4/7 Elia Pinto <andronicus.spiros@gmail.com>

> From: Elia Pinto <yersinia.spiros@gmail.com>
>
> This patch permit fixfiles to check /.autorelabel_excluded
> for a list of directories to exclude from relabelling.
>
> Inspired by this blog http://danwalsh.livejournal.com/38157.html.
>
> Signed-off-by: Elia Pinto <yersinia.spiros@gmail.com>
> ---
>  policycoreutils/scripts/fixfiles   |   45
> ++++++++++++++++++++++++++++++++---
>  policycoreutils/scripts/fixfiles.8 |    2 +
>  2 files changed, 43 insertions(+), 4 deletions(-)
>
> diff --git a/policycoreutils/scripts/fixfiles
> b/policycoreutils/scripts/fixfiles
> index ae519fc..2a39d74 100755
> --- a/policycoreutils/scripts/fixfiles
> +++ b/policycoreutils/scripts/fixfiles
> @@ -28,6 +28,7 @@ FORCEFLAG=""
>  DIRS=""
>  RPMILES=""
>  LOGFILE=`tty`
> +FINDEXCLUDEDPATH=""
>  if [ $? != 0 ]; then
>     LOGFILE="/dev/null"
>  fi
> @@ -46,6 +47,24 @@ else
>     FC=/etc/security/selinux/file_contexts
>  fi
>
> +# Add an excluded path for the following
> +# find in the function restore, relabel
> +
> +if [ -e /.autorelabel_excluded ]
> +then
> +       while read _p
> +       do
> +          # skip blank line and comment
> +          # skip not absolute path
> +          # skip not directory
> +          [ -z "${_p}" ] && continue
> +          [[ "${_p}" =~ "^[[:blank:]]*#" ]] && continue
> +          [[ ! "${_p}" =~ "^/.*" ]] && continue
> +          [[ ! -d "${_p}" ]] && continue
> +         FINDEXCLUDEDPATH="${FINDEXCLUDEDPATH} -o -path \"${_p}\""
> +       done < /.autorelabel_excluded
> +fi
> +
>  #
>  # Log to either syslog or a LOGFILE
>  #
> @@ -88,7 +107,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
>                fi; \
>             done | \
>        while read pattern ; do sh -c "find $pattern \
> -                     ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o
> -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype
> btrfs \) -prune  -o \
> +                     ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o
> -fstype ext4dev  -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype
> btrfs ${FINDEXCLUDEDPATH}\) -prune  -o \
>                      \( -wholename /home -o -wholename /root -o -wholename
> /tmp -wholename /dev \) -prune -o -print0"; \
>                      done 2> /dev/null | \
>         ${RESTORECON} $* -0 -f -
> @@ -115,6 +134,7 @@ rpm -q --qf '[%{FILESTATES} %{FILENAMES}\n]' "$1" |
> grep '^0 ' | cut -f2- -d ' '
>  # if called with -n will only check file context
>  #
>  restore () {
> +set -x
>  if [ ! -z "$PREFC" ]; then
>     diff_filecontext $*
>     exit $?
> @@ -127,8 +147,9 @@ if [ ! -z "$RPMFILES" ]; then
>  fi
>  if [ ! -z "$FILEPATH" ]; then
>     if [ -x /usr/bin/find ]; then
> +        loggit "skipping the directory ${FINDEXCLUDEDPATH//-o -path/} from
> relabelling"
>        /usr/bin/find "$FILEPATH" \
> -           ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype
> ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs \)
> -prune  -o -print0 | \
> +           ! \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype
> ext4dev -o -fstype gfs2 -o -fstype jfs -o -fstype xfs -o -fstype btrfs
> ${FINDEXCLUDEDPATH}\) -prune  -o -print0 | \
>            ${RESTORECON} ${FORCEFLAG} $* -0 -f - 2>&1 >> $LOGFILE
>     else
>        ${RESTORECON} ${FORCEFLAG} -R $* $FILEPATH 2>&1 >> $LOGFILE
> @@ -137,8 +158,24 @@ if [ ! -z "$FILEPATH" ]; then
>  fi
>  [ -x /usr/sbin/genhomedircon ] && /usr/sbin/genhomedircon
>  LogReadOnly
> -${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1
> >> $LOGFILE
> -rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
> +#
> +#
> +# "<<none>>" '/md/distro?(/.*)?'
> +TEMPFILE=`mktemp ${FC}.XXXXXXXXXX`
> +test -z "$TEMPFILE" && exit
> +cp -p ${FC} ${TEMPFILE}
> +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//-o -path/}
> +FINDEXCLUDEDPATH=${FINDEXCLUDEDPATH//\"/}
> +for _p in $FINDEXCLUDEDPATH
> +do
> +       _p="${_p%/}"
> +       _p1="${_p}(/.*)? -- <<none>>"
> +       echo "${_p1}" >> $TEMPFILE
> +        logit "skipping the directory ${_p} from relabelling"
> +done
> +
> +${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${TEMPFILE} ${FILESYSTEMSRW}
> 2>&1 >> $LOGFILE
> +rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFILE
>  find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec
> chcon -t tmp_t {} \;
>  find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \)
> -exec chcon -t tmp_t {} \;
>  exit $?
> diff --git a/policycoreutils/scripts/fixfiles.8
> b/policycoreutils/scripts/fixfiles.8
> index dfe8aa9..865aab4 100644
> --- a/policycoreutils/scripts/fixfiles.8
> +++ b/policycoreutils/scripts/fixfiles.8
> @@ -29,6 +29,8 @@ new policy, or  just check whether the file contexts are
> all
>  as you expect.  By default it will relabel all mounted ext2, ext3, xfs and
>  jfs file systems as long as they do not have a security context mount
>  option.  You can use the -R flag to use rpmpackages as an alternative.
> +The file /.autorelabel_exclude can contain a list of directory path
> +that fixfiles don't relabel.
>  .P
>  .B fixfiles onboot
>  will setup the machine to relabel on the next reboot.
> --
> 1.7.2.1.44.g721e7
>
>

[-- Attachment #2: Type: text/html, Size: 6606 bytes --]

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2011-04-11 18:35 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-04-07 15:47 [PATCH] Permit fixfiles to skip configurable directory from relabelling Elia Pinto
2011-04-07 15:53 ` Daniel J Walsh
2011-04-07 16:28   ` Elia Pinto
2011-04-08 17:14   ` Elia Pinto
2011-04-11 18:35     ` Daniel J Walsh
  -- strict thread matches above, loose matches on Subject: below --
2011-04-07 15:40 Elia Pinto
2011-04-07 15:46 ` Elia Pinto

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.