Re: possible regression with filecon equivalency

[Petr Lautrbach <lautrbach@redhat.com>]

Dominick Grift <dominick.grift@defensec.nl> writes:

> This worked a while ago:
>
> root@nimbus:~# cat >> /etc/selinux/dssp5-debian/contexts/files/file_contexts.subs_dist <<'EOF'
>> /foo /usr/bin
>> /sysroot/foo /usr/bin
>> EOF
>
> root@nimbus:~# matchpathcon -m dir /usr/bin
> /usr/bin        sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /foo
> /foo    sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /sysroot/foo
> /sysroot/foo    sys.id:sys.role:unknown.file:s0
>
> What happened?

i've bisected it to

4d436e4bf80284ac3b645bad022a9757dbc2dd36 is the first bad commit
commit 4d436e4bf80284ac3b645bad022a9757dbc2dd36
Author: Christian Göttsche <cgzones@googlemail.com>
Date:   Tue Nov 26 11:26:20 2024 +0100

    libselinux: use vector instead of linked list for substitutions
    
    Utilize cache locality for the substitutions by storing them in
    contiguous memory instead of a linked list.
    
    Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
    Acked-by: James Carter <jwcart2@gmail.com>



# cat /etc/selinux/targeted/contexts/files/file_contexts.subs
/new_root /
/new_root/foo /usr/bin

before 4d436e4bf80284ac3b645bad022a9757dbc2dd36:

# matchpathcon -m dir /new_root/foo
system_u:object_r:bin_t:s0

after

# matchpathcon -m dir /new_root/foo
/new_root/foo   system_u:object_r:default_t:s0



>
> -- 
> gpg --locate-keys dominick.grift@defensec.nl (wkd)
> Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
> Dominick Grift
> Mastodon: @kcinimod@defensec.nl