Label /usr/lib/getconf as bin_t
PATCH 1/1 Label /usr/lib/getconf as bin_t
On ArchLinux, glibc package installs /usr/bin/getconf as a hard link to a file in /usr/lib/getconf/. For example on a x86_64 machine:
$ ls -i -l /usr/bin/getconf /usr/lib/getconf/XBS5_LP64_OFF64
5900355 -rwxr-xr-x. 4 root root 22880 Feb 28 04:53 /usr/bin/getconf
5900355 -rwxr-xr-x. 4 root root 22880 Feb 28 04:53 /usr/lib/getconf/XBS5_LP64_OFF64Such configuration produces an instability when labeling the files with "restorecon -Rv /":
restorecon reset /usr/bin/getconf context unconfined_u:object_r:lib_t:s0->unconfined_u:object_r:bin_t:s0
restorecon reset /usr/lib/getconf/XBS5_LP64_OFF64 context unconfined_u:object_r:bin_t:s0->unconfined_u:object_r:lib_t:s0As /usr/lib/getconf directory only contains executable programs, this issue is fixed by labeling this directory and its content "bin_t".
--- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +1 -0
@@ -209,6 +209,7 @@ ifdef(`distro_gentoo',` /usr/lib/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) +/usr/lib/getconf(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/git-core/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/lib/git-core(/.*) -- gen_context(system_u:object_r:bin_t,s0)
Signature · 1 line
1.9.1
PATCH 1/1 Label /usr/lib/getconf as bin_t
Quoted 24 lines · Nicolas Iooss
On ArchLinux, glibc package installs
/usr/bin/getconfas a hard link to a file in/usr/lib/getconf/. For example on ax86_64machine:$ ls -i -l /usr/bin/getconf /usr/lib/getconf/XBS5_LP64_OFF64 5900355 -rwxr-xr-x. 4 root root 22880 Feb 28 04:53 /usr/bin/getconf 5900355 -rwxr-xr-x. 4 root root 22880 Feb 28 04:53 /usr/lib/getconf/XBS5_LP64_OFF64Such configuration produces an instability when labeling the files with "restorecon -Rv /":
restorecon reset /usr/bin/getconf context unconfined_u:object_r:lib_t:s0->unconfined_u:object_r:bin_t:s0 restorecon reset /usr/lib/getconf/XBS5_LP64_OFF64 context unconfined_u:object_r:bin_t:s0->unconfined_u:object_r:lib_t:s0As
/usr/lib/getconfdirectory only contains executable programs, this issue is fixed by labeling this directory and its content "bin_t".--- policy/modules/kernel/corecommands.fc | 1 + 1 file changed, 1 insertion(+)policy/modules/kernel/corecommands.fc +0
-0
policy/modules/kernel/corecommands.fc ifdef(`distro_gentoo',` · line 215
Quoted 7 lines
policy/modules/kernel/corecommands.fc +1
-0@@ -209,6 +209,7 @@ ifdef(`distro_gentoo',` /usr/lib/cyrus-imapd/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/dpkg/.+ -- gen_context(system_u:object_r:bin_t,s0) /usr/lib/emacsen-common/.* gen_context(system_u:object_r:bin_t,s0) +/usr/lib/getconf(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/gimp/.*/plug-ins(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/lib/git-core/git-shell -- gen_context(system_u:object_r:shell_exec_t,s0) /usr/lib/git-core(/.*) -- gen_context(system_u:object_r:bin_t,s0)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com