Re: possible regression with filecon equivalency

[Dominick Grift <dominick.grift@defensec.nl>]

Dominick Grift <dominick.grift@defensec.nl> writes:

In case its not clear. To clarify. I treat /usr/sbin like /usr/bin this
works fine. until it gets nested:

/fooroot / # treat /fooroot like / (works)
/fooroot/usr/sbin /usr/bin # treat /fooroot/usr/sbin like /usr/bin (no
longer works but use to work)

So now /fooroot/usr/sbin gets a label the equivalent of /usr because it
ignores to /fooroot/usr/sbin /usr/bin equivalency rule.

I hope that clears it up. I rely on this functionality.

> Dominick Grift <dominick.grift@defensec.nl> writes:
>
> example was too simple. Its more complicated:
>
> root@nimbus:~# matchpathcon -m dir /
> /       sys.id:sys.role:root.file:s0
> root@nimbus:~# matchpathcon -m dir /blaroot
> /blaroot        sys.id:sys.role:unknown.file:s0
> root@nimbus:~# matchpathcon -m dir /usr/bin
> /usr/bin        sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /usr/sbin
> /usr/sbin       sys.id:sys.role:exec.file:s0
> root@nimbus:~# cat >> /etc/selinux/dssp5-debian/contexts/files/file_contexts.subs_dist <<'EOF'
>> /blaroot /
>> /blaroot/usr/sbin /usr/bin
>> EOF
> root@nimbus:~# matchpathcon -m dir /
> /       sys.id:sys.role:root.file:s0
> root@nimbus:~# matchpathcon -m dir /blaroot
> /blaroot        sys.id:sys.role:root.file:s0
> root@nimbus:~# matchpathcon -m dir /usr/bin
> /usr/bin        sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /usr/sbin
> /usr/sbin       sys.id:sys.role:exec.file:s0
> root@nimbus:~# matchpathcon -m dir /blaroot/usr/sbin
> /blaroot/usr/sbin       sys.id:sys.role:data.file:s0
>
>> This worked a while ago:
>>
>> root@nimbus:~# cat >> /etc/selinux/dssp5-debian/contexts/files/file_contexts.subs_dist <<'EOF'
>>> /foo /usr/bin
>>> /sysroot/foo /usr/bin
>>> EOF
>>
>> root@nimbus:~# matchpathcon -m dir /usr/bin
>> /usr/bin        sys.id:sys.role:exec.file:s0
>> root@nimbus:~# matchpathcon -m dir /foo
>> /foo    sys.id:sys.role:exec.file:s0
>> root@nimbus:~# matchpathcon -m dir /sysroot/foo
>> /sysroot/foo    sys.id:sys.role:unknown.file:s0
>>
>> What happened?

-- 
gpg --locate-keys dominick.grift@defensec.nl (wkd)
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl