From: cpebenito@tresys.com (Christopher J. PeBenito)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] [PATCH] Label /usr/lib/getconf as bin_t
Date: Mon, 21 Apr 2014 10:17:31 -0400 [thread overview]
Message-ID: <5355287B.7030602@tresys.com> (raw)
In-Reply-To: <1397510107-5798-1-git-send-email-nicolas.iooss@m4x.org>
On 04/14/2014 05:15 PM, Nicolas Iooss wrote:
> On ArchLinux, glibc package installs /usr/bin/getconf as a hard link to a file
> in /usr/lib/getconf/. For example on a x86_64 machine:
>
> $ ls -i -l /usr/bin/getconf /usr/lib/getconf/XBS5_LP64_OFF64
> 5900355 -rwxr-xr-x. 4 root root 22880 Feb 28 04:53 /usr/bin/getconf
> 5900355 -rwxr-xr-x. 4 root root 22880 Feb 28 04:53 /usr/lib/getconf/XBS5_LP64_OFF64
>
> Such configuration produces an instability when labeling the files with
> "restorecon -Rv /":
>
> restorecon reset /usr/bin/getconf context unconfined_u:object_r:lib_t:s0->unconfined_u:object_r:bin_t:s0
> restorecon reset /usr/lib/getconf/XBS5_LP64_OFF64 context unconfined_u:object_r:bin_t:s0->unconfined_u:object_r:lib_t:s0
>
> As /usr/lib/getconf directory only contains executable programs, this issue is
> fixed by labeling this directory and its content "bin_t".
> ---
> policy/modules/kernel/corecommands.fc | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
> index acc9ddc..096c4fd 100644
> --- a/policy/modules/kernel/corecommands.fc
> +++ b/policy/modules/kernel/corecommands.fc
> @@ -209,6 +209,7 @@ ifdef(`distro_gentoo',`
> /usr/lib/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0)
> +/usr/lib/getconf(/.*)? gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0)
> /usr/lib/git-core/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0)
> /usr/lib/git-core(/.*) -- gen_context(system_u:object_r:bin_t,s0)
Merged.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
prev parent reply other threads:[~2014-04-21 14:17 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-14 21:15 [refpolicy] [PATCH] Label /usr/lib/getconf as bin_t Nicolas Iooss
2014-04-21 14:17 ` Christopher J. PeBenito [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5355287B.7030602@tresys.com \
--to=cpebenito@tresys.com \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.