From: Stephen Smalley <sds@tycho.nsa.gov>
To: Thomas COUDRAY <amanone@gmail.com>
Cc: jmorris@namei.org, linux-fsdevel@vger.kernel.org,
linux-kernel@vger.kernel.org, Eric Paris <eparis@parisplace.org>
Subject: Re: lgetxattr()/getxattr() return different values on a file labelled with selinux disabled
Date: Fri, 15 Mar 2013 08:53:40 -0400 [thread overview]
Message-ID: <514319D4.6050200@tycho.nsa.gov> (raw)
In-Reply-To: <CABhRnsWdD6Ef1kg=bud7RKpsQ7KeUhuQEw4Z2N_0RePgS=QDGg@mail.gmail.com>
On 03/15/2013 06:54 AM, Thomas COUDRAY wrote:
> Hi,
> I encounter trouble that I can't explain when labelling my files.
> Here are steps to reproduce (on both 3.2.37 and 3.7.3, with selinux, on
> an ext4 fs):
> 0 - have a regular file "f", with a "before_t" security.selinux attribute
> 1 - reboot with selinux=0
> 2 - change the label to "after_t" (setfattr or chcon)
> 3 - both "ls -Z" (who calls lgetxattr(2)) and "getfattr -n
> security.selinux" (who calls getxattr(2)) show "after_t"
> 4 - reboot with selinux enabled
> 5 - now ls prints "before_t", and getfattr "after_t".
>
> I ran a small test that calls both syscalls (lgetxattr/getxattr), I
> get "before_t" as expected
> If I touch /.autorelabel, both ls/getfattr give "before_t".
f is truly a regular file and not a symlink pointing to a regular file?
before_t and after_t are both defined in the policy?
before_t and after_t are not type aliases of each other?
What are the credentials (capabilities and SELinux security
context/permissions) of the process running the ls and getfattr commands?
Any relevant messages from SELinux in dmesg output?
next prev parent reply other threads:[~2013-03-15 12:53 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-15 10:54 lgetxattr()/getxattr() return different values on a file labelled with selinux disabled Thomas COUDRAY
2013-03-15 12:53 ` Stephen Smalley [this message]
2013-03-15 15:24 ` Thomas COUDRAY
2013-03-15 17:07 ` Stephen Smalley
2013-03-25 16:39 ` Thomas COUDRAY
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=514319D4.6050200@tycho.nsa.gov \
--to=sds@tycho.nsa.gov \
--cc=amanone@gmail.com \
--cc=eparis@parisplace.org \
--cc=jmorris@namei.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).