policycoreutils: fixfiles clean up /var/run and

PATCH In review Daniel J Walsh 5 participants 15 messages Aug 3, 2011 – Aug 5, 2011 1 message not in the archive SELinux security module

lore

Share & tools

lore

Daniel J Walsh

author

2011-08-03 20:56 UTC #0 lore raw

PATCH 29/155 policycoreutils: fixfiles clean up /var/run and

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This patch looks good to me. acked.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk45teYACgkQrlYvE4MpobN0IACfcWZx1inqKKn8GWqy2VpDu5Ls rSIAoNAYJ22tntOUF3elYf3u2fAFFTaM
=GJMM
-----END PGP SIGNATURE-----

Stephen Smalley

2011-08-04 14:56 UTC #1 lore raw

Quoted 7 lines · Daniel J Walsh

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This patch looks good to me. acked.
From dff45c3977973dfbdbc7261b6fef05215d3515d8 Mon Sep 17 00:00:00 2001

From: Eric Paris <[email protected]>
Date: Sun, 10 Jul 2011 13:35:32 +0200
Subject: [PATCH 029/155] policycoreutils: fixfiles clean up /var/run and
/var/lib/debug

clean up /var/run and /var/lib/debug just like we do for /tmp and /var/tmp since they can easily get unlabeled files.

Signed-off-by Eric Paris <[email protected]>

---
 policycoreutils/scripts/fixfiles |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

policycoreutils/scripts/fixfiles +2 -0

index 1da3fb2..c5c92bf 100755
@@ -142,6 +142,8 @@ rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
 find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) \( -type s -o -type p \) -delete
 find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
 find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
+find /var/run \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t var_run_t {} \;
+[ -e /var/lib/debug ] && find /var/lib/debug \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t lib_t {} \;
 exit $?
 }

Does it bother anyone else that you are hardcoding policy types into your scripts here? What happens when someone wants to use a different policy that doesn't define those types?

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Daniel J Walsh

author

2011-08-04 16:42 UTC #2 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 34 lines · Stephen Smalley

Quoted 7 lines · Daniel J Walsh
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
This patch looks good to me. acked.
From dff45c3977973dfbdbc7261b6fef05215d3515d8 Mon Sep 17 00:00:00 2001
From: Eric Paris <[email protected]> Date: Sun, 10 Jul 2011 13:35:32 +0200 Subject: [PATCH 029/155] policycoreutils: fixfiles clean up /var/run and /var/lib/debug
clean up /var/run and /var/lib/debug just like we do for /tmp and /var/tmp since they can easily get unlabeled files.
Signed-off-by Eric Paris <[email protected]> ---
policycoreutils/scripts/fixfiles | 2 ++ 1 files changed, 2
insertions(+), 0 deletions(-)
(quoted diff) +0 -0
b/policycoreutils/scripts/fixfiles index 1da3fb2..c5c92bf 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -142,6 +142,8 @@ rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* find /tmp $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ $ -type s -o -type p $ -delete find /tmp $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t tmp_t {} \; find /var/tmp $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t tmp_t {} \; +find /var/run $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t var_run_t {} \; +[ -e /var/lib/debug ] && find /var/lib/debug $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t lib_t {} \; exit $? }

Quoted 4 lines

Does it bother anyone else that you are hardcoding policy types into your scripts here? What happens when someone wants to use a different policy that doesn't define those types?

I guess we could add a file to identify the types of files with no
labels and files that the kernel does not understand. Patches welcome...

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk46y/0ACgkQrlYvE4MpobPIOQCg4HMijy8wQbb2A8N6Oq/YK9Cd 3jkAnilxruKeLvqm9Ca/tIU/I7959dL2
=C1vN
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Eric Paris

2011-08-04 17:33 UTC #3 lore raw

In reply to Stephen Smalley

Is there a reasonable way for a script to determine SECINITSID_UNLABELED? You're right though, it does sound like a good todo.

-Eric

Quoted 44 lines · Stephen Smalley

Quoted 7 lines · Daniel J Walsh
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This patch looks good to me. acked.
From dff45c3977973dfbdbc7261b6fef05215d3515d8 Mon Sep 17 00:00:00 2001
From: Eric Paris <[email protected]>
Date: Sun, 10 Jul 2011 13:35:32 +0200
Subject: [PATCH 029/155] policycoreutils: fixfiles clean up /var/run and /var/lib/debug
clean up /var/run and /var/lib/debug just like we do for /tmp and /var/tmp since they can easily get unlabeled files.
Signed-off-by Eric Paris <[email protected]>
---
policycoreutils/scripts/fixfiles | 2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
policycoreutils/scripts/fixfiles +0 -0
index 1da3fb2..c5c92bf 100755
@@ -142,6 +142,8 @@ rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
find /tmp $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ $ -type s -o -type p $ -delete
find /tmp $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t tmp_t {} \;
find /var/tmp $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t tmp_t {} \;
+find /var/run $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t var_run_t {} \;
+[ -e /var/lib/debug ] && find /var/lib/debug $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t lib_t {} \; exit $?
}
Does it bother anyone else that you are hardcoding policy types into your scripts here? What happens when someone wants to use a different policy that doesn't define those types?
--
Stephen Smalley
National Security Agency

Quoted 5 lines

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Christopher J. PeBenito

2011-08-04 19:16 UTC #4 lore raw

Quoted 3 lines · Eric Paris

Is there a reasonable way for a script to determine SECINITSID_UNLABELED? You're right though, it does sound like a good todo.

cat /selinux/initial_contexts/unlabeled

Quoted 39 lines · Stephen Smalley

Quoted 38 lines · Daniel J Walsh
Quoted 7 lines
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This patch looks good to me. acked.
From dff45c3977973dfbdbc7261b6fef05215d3515d8 Mon Sep 17 00:00:00 2001
From: Eric Paris<[email protected]>
Date: Sun, 10 Jul 2011 13:35:32 +0200
Subject: [PATCH 029/155] policycoreutils: fixfiles clean up /var/run and
/var/lib/debug
clean up /var/run and /var/lib/debug just like we do for /tmp and /var/tmp since they can easily get unlabeled files.
Signed-off-by Eric Paris<[email protected]>
---
  policycoreutils/scripts/fixfiles |    2 ++
  1 files changed, 2 insertions(+), 0 deletions(-)
policycoreutils/scripts/fixfiles +2 -0
index 1da3fb2..c5c92bf 100755
@@ -142,6 +142,8 @@ rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
  find /tmp $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ $ -type s -o -type p $ -delete
  find /tmp $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t tmp_t {} \;
  find /var/tmp $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t tmp_t {} \;
+find /var/run $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t var_run_t {} \;
+[ -e /var/lib/debug ]&&  find /var/lib/debug $ -context "*:file_t*" -o -context "*:unlabeled_t*" $ -exec chcon -t lib_t {} \;
  exit $?
  }
 
Does it bother anyone else that you are hardcoding policy types into your scripts here? What happens when someone wants to use a different policy that doesn't define those types?

Signature · 8 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

A message that is not in the archive (sent off-list or not yet received): CACLa4puk2gO=aV=oNj-Kmj=eSmYmquX0skKoCxso6o9tWcf_Ng@mail.gmail.com

Stephen Smalley

2011-08-04 19:33 UTC #6 lore raw

Quoted 3 lines · Eric Paris

well I guess [selinuxfs]/initial_contexts/unlabeled works for the first part, but how to come up with the lib_t/var_t I don't know....
more initial sids :)

chcon --reference=/lib ...
chcon --reference=/var ...

Or:
chcon matchpathcon /lib ...

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Daniel J Walsh

author

2011-08-04 20:26 UTC #7 lore raw

Quoted 10 lines · Stephen Smalley

Quoted 3 lines · Eric Paris
well I guess [selinuxfs]/initial_contexts/unlabeled works for the first part, but how to come up with the lib_t/var_t I don't
know.... more initial sids :)
chcon --reference=/lib ... chcon --reference=/var ...
Or: chcon matchpathcon /lib ...

How about this patch...

policycoreutils/scripts/fixfiles +32 -5

index 6de710a..9c1e6dd 100755
@@ -21,6 +21,31 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
 #
+# Get the default label returned from the kernel for a file with a lable the 
+# kernel does not understand
+#
+get_undefined_type() {
+    if [ -e /sys/fs/selinux/initial_contexts/unlabeled ]; then
+	UNKNOWN_LABEL=`cat /sys/fs/selinux/initial_contexts/unlabeled`
+    else
+	UNKNOWN_LABEL=`cat /selinux/initial_contexts/unlabeled`
+    fi
+    secon -t $UNKNOWN_LABEL
+}
+
+#
+# Get the default label for a file without a label
+#
+get_unlabeled_type() {
+    if [ -e /sys/fs/selinux/initial_contexts/unlabeled ]; then
+	NOLABEL=`cat /sys/fs/selinux/initial_contexts/file`
+    else
+	NOLABEL=`cat /selinux/initial_contexts/file`
+    fi
+    secon -t $NOLABEL
+}
+
+#
 # Get all mount points that support seclabel
 #
 get_all_labeled_mounts() {

@@ -200,11 +225,13 @@ fi
 ${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 | cat >> $LOGFILE
 rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFCFILE
 
-find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) \( -type s -o -type p \) -delete
-find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
-find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
-find /var/run \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t var_run_t {} \;
-[ -e /var/lib/debug ] && find /var/lib/debug \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t lib_t {} \;
+undefined=`get_undefined_type`
+unlabeled=`get_unlabeled_type`
+find /tmp \( -context "*:${unlabeled}*" -o -context "*:${undefined}*" \) \( -type s -o -type p \) -delete
+find /tmp \( -context "*:${unlabeled}*" -o -context "*:${undefined}*" \) -exec chcon --reference /tmp {} \;
+find /var/tmp \( -context "*:${unlabeled}*" -o -context "*:${undefined}*" \) -exec chcon --reference /var/tmp {} \;
+find /var/run \( -context "*:${unlabeled}*" -o -context "*:${undefined}*" \) -exec chcon --reference /var/run {} \;
+[ -e /var/lib/debug ] && find /var/lib/debug \( -context "*:${unlabeled}*" -o -context "*:${undefined}*" \) -exec chcon --reference /lib {} \;
 exit $?
 }

Eric Paris

2011-08-04 21:00 UTC #8 lore raw

Quoted 6 lines · Daniel J Walsh

Quoted 5 lines · Stephen Smalley
Quoted 3 lines · Eric Paris
well I guess [selinuxfs]/initial_contexts/unlabeled works for the first part, but how to come up with the lib_t/var_t I don't
know.... more initial sids :)

Quoted 8 lines

Quoted 5 lines
chcon --reference=/lib ... chcon --reference=/var ...
Or: chcon matchpathcon /lib ...
How about this patch...

If you don't have /selinux mounted in one of those two places secon -t will return your process type, which might delete the wrong files.

Not that it makes a huge difference, but we don't really need to pare it down to just the type with secon -t and then search using *$TYPE*.

I also question the use of /sys/fs/selinux/ but I'm not sure we have a good way to find that in a script..... Do we have one?

-Eric

Daniel J Walsh

author

2011-08-04 21:06 UTC #9 lore raw

Quoted 14 lines · Eric Paris

Quoted 13 lines · Daniel J Walsh
Quoted 10 lines · Stephen Smalley
Quoted 3 lines · Eric Paris
well I guess [selinuxfs]/initial_contexts/unlabeled works for the first part, but how to come up with the lib_t/var_t I
don't know.... more initial sids :)
chcon --reference=/lib ... chcon --reference=/var ...
Or: chcon matchpathcon /lib ...

Quoted 6 lines

Quoted 1 line
How about this patch...
If you don't have /selinux mounted in one of those two places secon -t will return your process type, which might delete the wrong files.

I guess we should just exit with an error if this happens.

Quoted 4 lines

Not that it makes a huge difference, but we don't really need to pare it down to just the type with secon -t and then search using *$TYPE*.

Well if you are using mcstransd the MLS field could be translated.

Quoted 3 lines

I also question the use of /sys/fs/selinux/ but I'm not sure we have a good way to find that in a script..... Do we have one?

grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'

Quoted 1 line

-Eric

Eric Paris

2011-08-04 21:10 UTC #10 lore raw

Quoted 7 lines · Daniel J Walsh

Quoted 3 lines · Eric Paris
I also question the use of /sys/fs/selinux/ but I'm not sure we have a good way to find that in a script..... Do we have one?
grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'

$ grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'
/selinux
/chroot/selinux

Daniel J Walsh

author

2011-08-04 21:50 UTC #11 lore raw

Quoted 9 lines · Eric Paris

Quoted 7 lines · Daniel J Walsh
Quoted 3 lines · Eric Paris
I also question the use of /sys/fs/selinux/ but I'm not sure we have a good way to find that in a script..... Do we have one?
grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'

Quoted 9 lines

$ grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }' /selinux 
/chroot/selinux
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Second attempt.

policycoreutils/scripts/fixfiles +24 -5

index 6de710a..899dce2 100755
@@ -21,6 +21,23 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 
 #
+# Get the default label returned from the kernel for a file with a lable the 
+# kernel does not understand
+#
+get_undefined_type() {
+    SELINUXMNT=`grep selinuxfs /proc/self/mountinfo | head -1 | awk '{ print $5 }'`
+    cat ${SELINUXMNT}/initial_contexts/unlabeled | secon -t
+}
+
+#
+# Get the default label for a file without a label
+#
+get_unlabeled_type() {
+    SELINUXMNT=`grep selinuxfs /proc/self/mountinfo | head -1 | awk '{ print $5 }'`
+    cat $SELINUXMNT/initial_contexts/file | secon -t 
+}
+
+#
 # Get all mount points that support seclabel
 #
 get_all_labeled_mounts() {

@@ -200,11 +217,13 @@ fi
 ${SETFILES} -q ${SYSLOGFLAG} ${FORCEFLAG} $* ${FC} ${FILESYSTEMSRW} 2>&1 | cat >> $LOGFILE
 rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-* $TEMPFCFILE
 
-find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) \( -type s -o -type p \) -delete
-find /tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
-find /var/tmp \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t tmp_t {} \;
-find /var/run \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t var_run_t {} \;
-[ -e /var/lib/debug ] && find /var/lib/debug \( -context "*:file_t*" -o -context "*:unlabeled_t*" \) -exec chcon -t lib_t {} \;
+UNDEFINED=`get_undefined_type` || exit $?
+UNLABELED=`get_unlabeled_type` || exit $?
+find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) \( -type s -o -type p \) -delete
+find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /tmp {} \;
+find /var/tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /var/tmp {} \;
+find /var/run \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /var/run {} \;
+[ -e /var/lib/debug ] && find /var/lib/debug \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /lib {} \;
 exit $?
 }

Stephen Smalley

2011-08-05 14:18 UTC #12 lore raw

Quoted 13 lines · Daniel J Walsh

Quoted 12 lines · Eric Paris
Quoted 7 lines · Daniel J Walsh
Quoted 3 lines · Eric Paris
I also question the use of /sys/fs/selinux/ but I'm not sure we have a good way to find that in a script..... Do we have one?
grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'
$ grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }' /selinux 
/chroot/selinux

Quoted 8 lines

Quoted 6 lines
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Second attempt.

Technically I think we wanted to encapsulate all references to selinuxfs by using libselinux, whether via direct bindings (as from python) or by adding utils to libselinux (for shell scripts). For example:

$ gcc -lselinux -o getinitialcontext getinitialcontext.c
$ ./getinitialcontext unlabeled
system_u:object_r:unlabeled_t:s0

Signature · 2 lines

Stephen Smalley
National Security Agency

#include <selinux/selinux.h>
#include <stdlib.h>
#include <stdio.h>

int main(int argc, char **argv)

{
	int rc;
	security_context_t con;
	if (argc != 2) {
		fprintf(stderr, "usage:  %s sid-name\n", argv[0]);
		exit(1);
	}
	rc = security_get_initial_context(argv[1], &con);
	if (rc < 0) {
		perror(argv[1]);
		exit(2);
	}
	printf("%s\n", con);
	freecon(con);
	exit(0);
}

Daniel J Walsh

author

2011-08-05 14:45 UTC #13 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 22 lines · Stephen Smalley

Quoted 21 lines · Daniel J Walsh
Quoted 19 lines · Eric Paris
Quoted 8 lines · Daniel J Walsh
Quoted 4 lines · Eric Paris
I also question the use of /sys/fs/selinux/ but I'm not sure we have a good way to find that in a script..... Do we have one?
grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'
$ grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'
/selinux /chroot/selinux
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Quoted 8 lines

Quoted 1 line
Second attempt.
Technically I think we wanted to encapsulate all references to selinuxfs by using libselinux, whether via direct bindings (as from python) or by adding utils to libselinux (for shell scripts). For
example: $ gcc -lselinux -o getinitialcontext getinitialcontext.c $ ./getinitialcontext unlabeled system_u:object_r:unlabeled_t:s0

If we are going to add any more commands to libselinux I would prefer them to be prefixed with selinux or at lease se. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk48AgIACgkQrlYvE4MpobOaHgCeKeAXbKuKtI/0nSfZ0CWBgqcC ogsAoNbjsH0obxI3HVx44LrAQxNlUc67
=aG/T
-----END PGP SIGNATURE-----

Eric Paris

2011-08-05 15:10 UTC #14 lore raw

Quoted 28 lines · Daniel J Walsh

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 24 lines · Stephen Smalley
Quoted 22 lines · Daniel J Walsh
Quoted 10 lines · Eric Paris
Quoted 8 lines · Daniel J Walsh
Quoted 4 lines · Eric Paris
I also question the use of /sys/fs/selinux/ but I'm not sure we have a good way to find that in a script..... Do we have one?
grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'
Quoted 9 lines
$ grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'
/selinux /chroot/selinux
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Second attempt.

Quoted 8 lines

Quoted 6 lines
Technically I think we wanted to encapsulate all references to selinuxfs by using libselinux, whether via direct bindings (as from python) or by adding utils to libselinux (for shell scripts). For
example: $ gcc -lselinux -o getinitialcontext getinitialcontext.c $ ./getinitialcontext unlabeled system_u:object_r:unlabeled_t:s0
If we are going to add any more commands to libselinux I would prefer them to be prefixed with selinux or at lease se.

no problem, I can call it anything we want. Last issue I question is better handling of there being no result. We wouldn't want to delete
context'**' :)

-Eric

Daniel J Walsh

author

2011-08-05 15:34 UTC #15 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 35 lines · Eric Paris

Quoted 34 lines · Daniel J Walsh
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Quoted 31 lines · Stephen Smalley
Quoted 14 lines · Daniel J Walsh
Quoted 13 lines · Eric Paris
Quoted 8 lines · Daniel J Walsh
Quoted 4 lines · Eric Paris
I also question the use of /sys/fs/selinux/ but I'm not sure we have a good way to find that in a script..... Do we have one?
grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }'
$ grep selinuxfs /proc/self/mountinfo | awk '{ print $5 }' 
/selinux /chroot/selinux
Quoted 8 lines
Quoted 6 lines
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Second attempt.
Technically I think we wanted to encapsulate all references to selinuxfs by using libselinux, whether via direct bindings (as from python) or by adding utils to libselinux (for shell scripts). For example: $ gcc -lselinux -o getinitialcontext getinitialcontext.c $ ./getinitialcontext unlabeled system_u:object_r:unlabeled_t:s0

Quoted 7 lines

Quoted 2 lines
If we are going to add any more commands to libselinux I would prefer them to be prefixed with selinux or at lease se.
no problem, I can call it anything we want. Last issue I question is better handling of there being no result. We wouldn't want to
delete context'**' :)

Well it would actually delete *:*, and they are tmp files ... echo "" | secon -t
secon: Couldn't read security context: Invalid argument [Exit 1]
touch /tmp/dan1

# touch /tmp/empty
# cat /tmp/empty | secon -t
secon:  Couldn't read security context: Invalid argument
[Exit 1]

So I think you are going to get an error and the app will blow up.

Quoted 9 lines

-Eric
-- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk48DX4ACgkQrlYvE4MpobONaQCfTFsE84KQ4kiM1Y13+sz2ydyu ZvcAoMihWiC9u+v0J/0gBrhc9iSkPbm5
=7VRP
-----END PGP SIGNATURE-----