Introduce substitution for /usr/local/lib* and /etc/init.d
v2 cover Introduce substitution for /usr/local/lib* and /etc/init.d
This patchset contains the suggestion to also have a substitition for /usr/local/lib* towards /usr/lib since manually installed applications use /usr/local/lib* for their libraries (instead of /usr/lib) but *should* have the same structure otherwise.
This is not only to clean up the defined file contexts a bit (there are not that many references to /usr/local) but mainly to support such installed applications almost out-of-the-box with our policies.
A second substitution is for init scripts defined in /etc/init\.d, which we now map to /etc/rc\.d/init\.d (already used in the majority of cases in the policy). For those distributions that do use /etc/init\.d though they need to take care to always use /etc/rc\.d/init\.d since the translation (substitution) takes precedence before the file contexts are looked at.
Changelog since v1
------------------
- Removed translation of /usr/local to /usr
- Added translation for /etc/init.d to /etc/rc.d/init.d
PATCH v2 1/2 Use substititions for /usr/local/lib and /etc/init.d
Introduce the substitutions for the /usr/local/lib* locations (towards /usr/lib) and /etc/init.d (towards /etc/rc.d/init.d).
Update the file contexts of the translated locations.
--- config/file_contexts.subs_dist | 4 ++++ policy/modules/kernel/corecommands.fc | 3 --- policy/modules/kernel/files.fc | 2 +- policy/modules/services/xserver.fc | 4 ++-- policy/modules/system/init.fc | 2 -- policy/modules/system/ipsec.fc | 5 ----- policy/modules/system/libraries.fc | 1 - 7 files changed, 7 insertions(+), 14 deletions(-)
config/file_contexts.subs_dist +4 -0
@@ -1,7 +1,11 @@ +/etc/init.d /etc/rc.d/init.d /lib32 /lib /lib64 /lib /run /var/run /run/lock /var/lock /usr/lib32 /usr/lib /usr/lib64 /usr/lib +/usr/local/lib32 /usr/lib +/usr/local/lib64 /usr/lib +/usr/local/lib/ /usr/lib/ /var/run/lock /var/lock
policy/modules/kernel/corecommands.fc +0 -3
@@ -66,8 +66,6 @@ ifdef(`distro_redhat',` /etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0) /etc/hotplug\.d/default/default.* gen_context(system_u:object_r:bin_t,s0) -/etc/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) - /etc/kde/env(/.*)? gen_context(system_u:object_r:bin_t,s0) /etc/kde/shutdown(/.*)? gen_context(system_u:object_r:bin_t,s0)
@@ -257,7 +255,6 @@ ifdef(`distro_gentoo',` /usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0) -/usr/local/lib(64)?/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/local/Brother(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/local/Printer(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/local/linuxprinter/filters(/.*)? gen_context(system_u:object_r:bin_t,s0)
policy/modules/kernel/files.fc +1 -1
@@ -84,7 +84,7 @@ ifdef(`distro_redhat',` ifdef(`distro_suse',` /etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0) -/etc/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0) +/etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0) ') #
policy/modules/services/xserver.fc +2 -2
@@ -22,13 +22,13 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) /etc/gdm/PreSession/.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/gdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) -/etc/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0) - /etc/kde[34]?/kdm/Xstartup -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/kde[34]?/kdm/Xreset -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/kde[34]?/kdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/kde[34]?/kdm/backgroundrc gen_context(system_u:object_r:xdm_var_run_t,s0) +/etc/rc\.d/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0) + /etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
policy/modules/system/init.fc +0 -2
@@ -1,8 +1,6 @@ # # /etc # -/etc/init\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0) - /etc/rc\.d/rc -- gen_context(system_u:object_r:initrc_exec_t,s0) /etc/rc\.d/rc\.[^/]+ -- gen_context(system_u:object_r:initrc_exec_t,s0)
policy/modules/system/ipsec.fc +0 -5
@@ -27,11 +27,6 @@ /usr/libexec/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0) /usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0) -/usr/local/lib(64)?/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0) - /usr/sbin/ipsec -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0) /usr/sbin/racoon -- gen_context(system_u:object_r:racoon_exec_t,s0) /usr/sbin/setkey -- gen_context(system_u:object_r:setkey_exec_t,s0)
policy/modules/system/libraries.fc +0 -1
@@ -242,7 +242,6 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_ /usr/lib.*/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/local(/.*)?/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -/usr/local/lib/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) HOME_DIR/.*/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
Signature · 1 line
1.7.8.6
PATCH v2 1/2 Use substititions for /usr/local/lib and /etc/init.d
Quoted 38 lines · Sven Vermeulen
Introduce the substitutions for the
/usr/local/lib*locations (towards/usr/lib) and/etc/init.d(towards/etc/rc.d/init.d).Update the file contexts of the translated locations.
Signed-off-by Sven Vermeulen <[email protected]>--- config/file_contexts.subs_dist | 4 ++++ policy/modules/kernel/corecommands.fc | 3 --- policy/modules/kernel/files.fc | 2 +- policy/modules/services/xserver.fc | 4 ++-- policy/modules/system/init.fc | 2 -- policy/modules/system/ipsec.fc | 5 ----- policy/modules/system/libraries.fc | 1 - 7 files changed, 7 insertions(+), 14 deletions(-)config/file_contexts.subs_dist +4
-0@@ -1,7 +1,11 @@ +/etc/init.d /etc/rc.d/init.d /lib32 /lib /lib64 /lib /run /var/run /run/lock /var/lock /usr/lib32 /usr/lib /usr/lib64 /usr/lib +/usr/local/lib32 /usr/lib +/usr/local/lib64 /usr/lib +/usr/local/lib/ /usr/lib/ /var/run/lock /var/lockpolicy/modules/kernel/corecommands.fc +0
-0
policy/modules/kernel/corecommands.fc ifdef(`distro_redhat',` · line 70
Quoted 5 lines
policy/modules/kernel/corecommands.fc +0
-2@@ -66,8 +66,6 @@ ifdef(`distro_redhat',` /etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0) /etc/hotplug\.d/default/default.* gen_context(system_u:object_r:bin_t,s0) -/etc/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) -
My advice is to leave this (and a couple more) for safety, as it would probably do more good than harm. The substitution file is a configuration file and it can be edited erroneously.
Quoted 16 lines
policy/modules/kernel/corecommands.fc +0
-1/etc/kde/env(/.*)? gen_context(system_u:object_r:bin_t,s0) /etc/kde/shutdown(/.*)? gen_context(system_u:object_r:bin_t,s0)@@ -257,7 +255,6 @@ ifdef(`distro_gentoo',` /usr/libexec/openssh/sftp-server -- gen_context(system_u:object_r:bin_t,s0) -/usr/local/lib(64)?/ipsec/.* -- gen_context(system_u:object_r:bin_t,s0) /usr/local/Brother(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/local/Printer(/.*)? gen_context(system_u:object_r:bin_t,s0) /usr/local/linuxprinter/filters(/.*)? gen_context(system_u:object_r:bin_t,s0)policy/modules/kernel/files.fc +0
-0
policy/modules/kernel/files.fc ifdef(`distro_redhat',` · line 87
Quoted 4 lines
policy/modules/kernel/files.fc +0
-1@@ -84,7 +84,7 @@ ifdef(`distro_redhat',` ifdef(`distro_suse',` /etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0) -/etc/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
My advice is to leave this (and a couple more) for safety, as it would probably do more good than harm. The substitution file is a configuration file and it can be edited erroneously.
Also, I think it's dangerous to edit inside the distribution ifdefs.
Quoted 29 lines
policy/modules/kernel/files.fc +1
-0+/etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0) ') #policy/modules/services/xserver.fc +2
-2@@ -22,13 +22,13 @@ HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) /etc/gdm/PreSession/.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/gdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) -/etc/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0) - /etc/kde[34]?/kdm/Xstartup -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/kde[34]?/kdm/Xreset -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/kde[34]?/kdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/kde[34]?/kdm/backgroundrc gen_context(system_u:object_r:xdm_var_run_t,s0) +/etc/rc\.d/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0) + /etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0) /etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)policy/modules/system/init.fc +0
-0
policy/modules/system/init.fc line 5
Quoted 5 lines
policy/modules/system/init.fc +0
-2@@ -1,8 +1,6 @@ # # /etc # -/etc/init\.d/.* -- gen_context(system_u:object_r:initrc_exec_t,s0) -
My advice is to leave this (and a couple more) for safety, as it would probably do more good than harm. The substitution file is a configuration file and it can be edited erroneously.
Quoted 8 lines
policy/modules/system/init.fc +0
-0/etc/rc\.d/rc -- gen_context(system_u:object_r:initrc_exec_t,s0) /etc/rc\.d/rc\.[^/]+ -- gen_context(system_u:object_r:initrc_exec_t,s0)policy/modules/system/ipsec.fc +0
-0
policy/modules/system/ipsec.fc line 34
Quoted 8 lines
policy/modules/system/ipsec.fc +0
-5@@ -27,11 +27,6 @@ /usr/libexec/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0) /usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0) -/usr/local/lib(64)?/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0) -
You have not replaced the above four entries with anything... Even if it was obsolete stuff, I would recommend not removing them completely unless, say, the obsolete source code is no longer available at the main distribution point.
Quoted 16 lines
policy/modules/system/ipsec.fc +0
-0/usr/sbin/ipsec -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0) /usr/sbin/racoon -- gen_context(system_u:object_r:racoon_exec_t,s0) /usr/sbin/setkey -- gen_context(system_u:object_r:setkey_exec_t,s0)policy/modules/system/libraries.fc +0
-1@@ -242,7 +242,6 @@ HOME_DIR/.*/plugins/nppdf\.so.* -- gen_context(system_u:object_r:textrel_shlib_ /usr/lib.*/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/local(/.*)?/libmpg123\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) /usr/lib/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) -/usr/local/lib/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0) HOME_DIR/.*/plugins/nppdf\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0) HOME_DIR/.mozilla/plugins/nprhapengine\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
PATCH v2 1/2 Use substititions for /usr/local/lib and /etc/init.d
Quoted 8 lines · Guido Trentalancia
Quoted 8 lines
policy/modules/kernel/corecommands.fc +0
-0@@ -66,8 +66,6 @@ ifdef(`distro_redhat',` /etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0) /etc/hotplug\.d/default/default.* gen_context(system_u:object_r:bin_t,s0)
Quoted 6 lines
policy/modules/kernel/corecommands.fc ifdef(`distro_redhat',` · line 70
Quoted 2 lines
policy/modules/kernel/corecommands.fc +0
-2-/etc/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) -My advice is to leave this (and a couple more) for safety, as it would probably do more good than harm. The substitution file is a configuration file and it can be edited erroneously.
I disagree. If we would leave in these file context definitions - which will never be hit in the first place if the file context substitution file is correct - it would give a false sense towards the policy administrators that it is a "good" rule.
Say some policy editor wants to have /etc/init.d/functions labeled shell_exec_t or so instead. If he would do
/etc/init\.d/functions-- gen_context(system_u:object_r:shell_exec_t,s0)
he'll have a hard time figuring out why it still labels as bin_t.
Quoted 9 lines
policy/modules/kernel/corecommands.fc ifdef(`distro_redhat',` · line 73
Quoted 3 lines
policy/modules/kernel/corecommands.fc +0
-1ifdef(`distro_suse',` /etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0) -/etc/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)My advice is to leave this (and a couple more) for safety, as it would probably do more good than harm. The substitution file is a configuration file and it can be edited erroneously.
Also, I think it's dangerous to edit inside the distribution ifdefs.
Why would it be dangerous? The substitutions are done regardless of the distro_suse value. Keeping it for /etc/init.d would again yield the impression that it is a valid one.
Quoted 8 lines
Quoted 8 lines
policy/modules/system/ipsec.fc +0
-0@@ -27,11 +27,6 @@ /usr/libexec/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0) /usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
Quoted 10 lines
policy/modules/system/ipsec.fc line 34
Quoted 5 lines
policy/modules/system/ipsec.fc +0
-5-/usr/local/lib(64)?/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0) -You have not replaced the above four entries with anything... Even if it was obsolete stuff, I would recommend not removing them completely unless, say, the obsolete source code is no longer available at the main distribution point.
They don't need to. A bit higher in the file context file, you'll find definitions for /usr/lib/ipsec/eroute. That is the destination of the file substitutions anyhow. In other words, the above ones are obsolete.
What do you mean with "obsolete source code is no longer available at the main distribution point"?
Wkr,
Sven Vermeulen
PATCH v2 1/2 Use substititions for /usr/local/lib and /etc/init.d
Hello Sven.
Quoted 16 lines · Sven Vermeulen
Quoted 8 lines · Guido Trentalancia
Quoted 8 lines
policy/modules/kernel/corecommands.fc +0
-0@@ -66,8 +66,6 @@ ifdef(`distro_redhat',` /etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0) /etc/hotplug\.d/default/default.* gen_context(system_u:object_r:bin_t,s0)Quoted 6 lines
policy/modules/kernel/corecommands.fc ifdef(`distro_redhat',` · line 70
Quoted 2 lines
policy/modules/kernel/corecommands.fc +0
-2-/etc/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) -My advice is to leave this (and a couple more) for safety, as it would probably do more good than harm. The substitution file is a configuration file and it can be edited erroneously.
Quoted 4 lines
I disagree. If we would leave in these file context definitions - which will never be hit in the first place if the file context substitution file is correct - it would give a false sense towards the policy administrators that it is a "good" rule.
"Substitution of /etc/rc.d/init.d with /etc/init.d" should leave /etc/init.d unmodified (thus producing only a duplicate entry in the worst case). If a duplicate entry with the same context is detected as an error by setfiles, perhaps the latter should be modified (so that it produces at most a warning).
Quoted 4 lines
Say some policy editor wants to have
/etc/init.d/functionslabeledshell_exec_tor so instead. If he would do
/etc/init\.d/functions--gen_context(system_u:object_r:shell_exec_t,s0)
he'll have a hard time figuring out why it still labels asbin_t.
Do you mean perhaps that if he or she only modifies the first one and then leaves the second one as it is and also inadvertently modifies file_contexts.sub_dist so that is substitutes /etc/rc.d/init.d with /etc/init.d, the result is inconsistent ?
If so, I think that setfiles would detect it. I can't remember exactly now whether it just prints out a warning or if it counts as an error, although there is a minimum number of errors that are "tolerated" at present...
Quoted 8 lines
Quoted 8 lines
policy/modules/kernel/corecommands.fc ifdef(`distro_redhat',` · line 73
Quoted 3 lines
policy/modules/kernel/corecommands.fc +0
-1ifdef(`distro_suse',` /etc/defkeymap\.map -- gen_context(system_u:object_r:etc_runtime_t,s0) -/etc/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)My advice is to leave this (and a couple more) for safety, as it would probably do more good than harm. The substitution file is a configuration file and it can be edited erroneously.
Quoted 5 lines
Quoted 1 line
Also, I think it's dangerous to edit inside the distribution ifdefs.
Why would it be dangerous? The substitutions are done regardless of the
distro_susevalue. Keeping it for/etc/init.dwould again yield the impression that it is a valid one.
Substituting inside the ifdef distro values might not be desirable, however I am not a distribution packager/maintainer, therefore I don't know exactly. If I was a distribution packager/maintainer however, I would not push for that.
Quoted 8 lines
Quoted 8 lines
Quoted 8 lines
policy/modules/system/ipsec.fc +0
-0@@ -27,11 +27,6 @@ /usr/libexec/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0) /usr/libexec/nm-openswan-service -- gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
Quoted 10 lines
Quoted 10 lines
policy/modules/system/ipsec.fc line 34
Quoted 5 lines
policy/modules/system/ipsec.fc +0
-5-/usr/local/lib(64)?/ipsec/eroute -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/pluto -- gen_context(system_u:object_r:ipsec_exec_t,s0) -/usr/local/lib(64)?/ipsec/spi -- gen_context(system_u:object_r:ipsec_exec_t,s0) -You have not replaced the above four entries with anything... Even if it was obsolete stuff, I would recommend not removing them completely unless, say, the obsolete source code is no longer available at the main distribution point.
...and by all distributions actually.
Quoted 3 lines
They don't need to. A bit higher in the file context file, you'll find definitions for
/usr/lib/ipsec/eroute. That is the destination of the file substitutions anyhow. In other words, the above ones are obsolete.
Well, that's fine then, my short-sight !
Quoted 2 lines
What do you mean with "obsolete source code is no longer available at the main distribution point"?
I mean when the source code for a given piece of software is no longer available from anywhere, including from any distribution (which still bears some risk).
Quoted 2 lines
Wkr,
Sven Vermeulen
Kind regards,
Guido
PATCH v2 1/2 Use substititions for /usr/local/lib and /etc/init.d
Quoted 18 lines · Guido Trentalancia
Quoted 13 lines
Quoted 6 lines
Quoted 6 lines
policy/modules/kernel/corecommands.fc +0
-0@@ -66,8 +66,6 @@ ifdef(`distro_redhat',` /etc/hotplug/hotplug\.functions -- gen_context(system_u:object_r:bin_t,s0) /etc/hotplug\.d/default/default.* gen_context(system_u:object_r:bin_t,s0)Quoted 6 lines
policy/modules/kernel/corecommands.fc ifdef(`distro_redhat',` · line 70
Quoted 2 lines
policy/modules/kernel/corecommands.fc +0
-2-/etc/init\.d/functions -- gen_context(system_u:object_r:bin_t,s0) -My advice is to leave this (and a couple more) for safety, as it would probably do more good than harm. The substitution file is a configuration file and it can be edited erroneously.
Quoted 4 lines
I disagree. If we would leave in these file context definitions - which will never be hit in the first place if the file context substitution file is correct - it would give a false sense towards the policy administrators that it is a "good" rule.
Quoted 5 lines
"Substitution of
/etc/rc.d/init.dwith/etc/init.d" should leave/etc/init.dunmodified (thus producing only a duplicate entry in the worst case). If a duplicate entry with the same context is detected as an error by setfiles, perhaps the latter should be modified (so that it produces at most a warning).
Setfiles doesn't see this as a duplicate entry as far as I can remember. It looks at the file path and tries to match it against the file contexts /after/ substitution. In other words, the file contexts that use a path that is substituted away from (like /etc/init.d) are just dead code.
Quoted 9 lines
Quoted 4 lines
Say some policy editor wants to have
/etc/init.d/functionslabeledshell_exec_tor so instead. If he would do
/etc/init\.d/functions--gen_context(system_u:object_r:shell_exec_t,s0)
he'll have a hard time figuring out why it still labels asbin_t.Do you mean perhaps that if he or she only modifies the first one and then leaves the second one as it is and also inadvertently modifies file_contexts.sub_dist so that is substitutes
/etc/rc.d/init.dwith/etc/init.d, the result is inconsistent ?
No, what I mean is the following.
Before my commit, you have both /etc/init.d/blabla and /etc/rc.d/init.d/blabla rules in the file contexts. In the commit, a substitution rule is added stating that every file path with /etc/init.d should be looked at as if it was /etc/rc.d/init.d in the file contexts.
So what you now have is that each and every /etc/init.d line in the file contexts is never going to be used anymore. It is also never really looked at.
However, if I as a policy editor see both /etc/init.d and /etc/rc.d/init.d used in the policy, I would *assume* that they are still both valid - which isn't the case.
By only seeing /etc/rc.d/init.d in the entire code, it makes more sense to me to not just quickly add in a /etc/init.d (because that would be the first, even though "it works") and I will remember that a file context substitution entry is in place.
Quoted 6 lines
Quoted 4 lines
Quoted 4 lines
You have not replaced the above four entries with anything... Even if it was obsolete stuff, I would recommend not removing them completely unless, say, the obsolete source code is no longer available at the main distribution point.
...and by all distributions actually.
The moment a distribution pulls in from refpolicy, the substitutions are in place.
Don't forget that, what I did here in the patch (i.e. introduce the substitution and update all file contexts to match it) is no different from the substitution for /usr/lib64 and /usr/lib32 to /usr/lib a while ago.
There too, all contexts were updated to reflect the new, "substituted" situation. I don't see why the substitutions for /etc/init.d would be any different.
Wkr,
Sven Vermeulen
PATCH v2 2/2 Update with new substitutions
In reply to Sven VermeulenThe recently introduced substitutions for /usr/local/lib* and /etc/init.d also reflect in the file contexts of a few contrib modules.
--- hadoop.fc | 7 ------- inetd.fc | 2 +- tmpreaper.fc | 4 ++-- 3 files changed, 3 insertions(+), 10 deletions(-)
hadoop.fc +0 -7
@@ -1,12 +1,5 @@ /etc/hadoop.* gen_context(system_u:object_r:hadoop_etc_t,s0) -/etc/init\.d/hadoop-(.*-)?datanode -- gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?jobtracker -- gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?namenode -- gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?secondarynamenode -- gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?tasktracker -- gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0) -/etc/init\.d/zookeeper -- gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0) - /etc/rc\.d/init\.d/hadoop-(.*-)?datanode -- gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0) /etc/rc\.d/init\.d/hadoop-(.*-)?jobtracker -- gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0) /etc/rc\.d/init\.d/hadoop-(.*-)?namenode -- gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0)
inetd.fc +1 -1
@@ -1,7 +1,7 @@ +/usr/lib/pysieved/pysieved.*\.py -- gen_context(system_u:object_r:inetd_child_exec_t,s0) /usr/sbin/identd -- gen_context(system_u:object_r:inetd_child_exec_t,s0) /usr/sbin/in\..*d -- gen_context(system_u:object_r:inetd_child_exec_t,s0) -/usr/local/lib/pysieved/pysieved.*\.py -- gen_context(system_u:object_r:inetd_child_exec_t,s0) /usr/sbin/inetd -- gen_context(system_u:object_r:inetd_exec_t,s0) /usr/sbin/rlinetd -- gen_context(system_u:object_r:inetd_exec_t,s0)
tmpreaper.fc +2 -2
@@ -1,6 +1,6 @@ ifdef(`distro_debian',` -/etc/init\.d/mountall-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) -/etc/init\.d/mountnfs-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) +/etc/rc\.d/init\.d/mountall-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) +/etc/rc\.d/init\.d/mountnfs-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) ') /usr/sbin/tmpreaper -- gen_context(system_u:object_r:tmpreaper_exec_t,s0)
Signature · 1 line
1.7.8.6
PATCH v2 2/2 Update with new substitutions
Quoted 15 lines · Sven Vermeulen
The recently introduced substitutions for
/usr/local/lib*and/etc/init.dalso reflect in the file contexts of a few contrib modules.Signed-off-by Sven Vermeulen <[email protected]>--- hadoop.fc | 7 ------- inetd.fc | 2 +- tmpreaper.fc | 4 ++-- 3 files changed, 3 insertions(+), 10 deletions(-)hadoop.fc +0
-0
hadoop.fc line 9
Quoted 9 lines
hadoop.fc +0
-7@@ -1,12 +1,5 @@ /etc/hadoop.* gen_context(system_u:object_r:hadoop_etc_t,s0) -/etc/init\.d/hadoop-(.*-)?datanode -- gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?jobtracker -- gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?namenode -- gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?secondarynamenode -- gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?tasktracker -- gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0) -/etc/init\.d/zookeeper -- gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0) -
zookeeper would not appear anymore if you remove it completely instead of translating it (look three lines further below).
Quoted 21 lines
hadoop.fc +0
-0/etc/rc\.d/init\.d/hadoop-(.*-)?datanode -- gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0) /etc/rc\.d/init\.d/hadoop-(.*-)?jobtracker -- gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0) /etc/rc\.d/init\.d/hadoop-(.*-)?namenode -- gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0)inetd.fc +1
-1@@ -1,7 +1,7 @@ +/usr/lib/pysieved/pysieved.*\.py -- gen_context(system_u:object_r:inetd_child_exec_t,s0) /usr/sbin/identd -- gen_context(system_u:object_r:inetd_child_exec_t,s0) /usr/sbin/in\..*d -- gen_context(system_u:object_r:inetd_child_exec_t,s0) -/usr/local/lib/pysieved/pysieved.*\.py -- gen_context(system_u:object_r:inetd_child_exec_t,s0) /usr/sbin/inetd -- gen_context(system_u:object_r:inetd_exec_t,s0) /usr/sbin/rlinetd -- gen_context(system_u:object_r:inetd_exec_t,s0)tmpreaper.fc +0
-0
tmpreaper.fc line 3
Quoted 5 lines
tmpreaper.fc +2
-2@@ -1,6 +1,6 @@ ifdef(`distro_debian',` -/etc/init\.d/mountall-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) -/etc/init\.d/mountnfs-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) +/etc/rc\.d/init\.d/mountall-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) +/etc/rc\.d/init\.d/mountnfs-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0)
Personally speaking, I would not touch what's inside the ifdefs, unless it's a very well known distribution that one is regularly and actively using.
Quoted 4 lines
tmpreaper.fc +0
-0') /usr/sbin/tmpreaper -- gen_context(system_u:object_r:tmpreaper_exec_t,s0)
PATCH v2 2/2 Update with new substitutions
Quoted 7 lines · Guido Trentalancia
Quoted 7 lines
hadoop.fc +0
-0@@ -1,12 +1,5 @@ /etc/hadoop.* gen_context(system_u:object_r:hadoop_etc_t,s0)
Quoted 10 lines
hadoop.fc line 9
Quoted 7 lines
hadoop.fc +0
-7-/etc/init\.d/hadoop-(.*-)?datanode -- gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?jobtracker -- gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?namenode -- gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?secondarynamenode -- gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?tasktracker -- gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0) -/etc/init\.d/zookeeper -- gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0) -zookeeper would not appear anymore if you remove it completely instead of translating it (look three lines further below).
You're right, I was a bit too zealous with deleting lines here.
Quoted 6 lines
Quoted 6 lines
tmpreaper.fc +0
-0@@ -1,6 +1,6 @@ ifdef(`distro_debian',`
Quoted 8 lines
tmpreaper.fc line 3
Quoted 4 lines
tmpreaper.fc +2
-2-/etc/init\.d/mountall-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) -/etc/init\.d/mountnfs-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) +/etc/rc\.d/init\.d/mountall-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) +/etc/rc\.d/init\.d/mountnfs-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0)Personally speaking, I would not touch what's inside the ifdefs, unless it's a very well known distribution that one is regularly and actively using.
If I didn't, then the rules for tmpreaper_exec_t would never be hit, and in this case the Debian distribution would fail to have a properly labeled /etc/init.d/mountall-bootclean.sh script.
Wkr,
Sven Vermeulen
PATCH v2 2/2 Update with new substitutions
Hello Sven.
Quoted 19 lines · Sven Vermeulen
Quoted 7 lines · Guido Trentalancia
Quoted 7 lines
hadoop.fc +0
-0@@ -1,12 +1,5 @@ /etc/hadoop.* gen_context(system_u:object_r:hadoop_etc_t,s0)Quoted 10 lines
hadoop.fc line 9
Quoted 7 lines
hadoop.fc +0
-7-/etc/init\.d/hadoop-(.*-)?datanode -- gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?jobtracker -- gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?namenode -- gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?secondarynamenode -- gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0) -/etc/init\.d/hadoop-(.*-)?tasktracker -- gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0) -/etc/init\.d/zookeeper -- gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0) -zookeeper would not appear anymore if you remove it completely instead of translating it (look three lines further below).
Quoted 1 line
You're right, I was a bit too zealous with deleting lines here.
To say it all, in my opinion, there should only be one if the original package only installs one (1:1) and all the rest should go under customizations from the various distributions, because otherwise it might one day become unmanageable and even lead to errors.
But I was too lazy to go and find out what the original naming actually is.
Quoted 15 lines
Quoted 6 lines
Quoted 6 lines
tmpreaper.fc +0
-0@@ -1,6 +1,6 @@ ifdef(`distro_debian',`Quoted 8 lines
tmpreaper.fc line 3
Quoted 4 lines
tmpreaper.fc +2
-2-/etc/init\.d/mountall-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) -/etc/init\.d/mountnfs-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) +/etc/rc\.d/init\.d/mountall-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0) +/etc/rc\.d/init\.d/mountnfs-bootclean.sh -- gen_context(system_u:object_r:tmpreaper_exec_t,s0)Personally speaking, I would not touch what's inside the ifdefs, unless it's a very well known distribution that one is regularly and actively using.
Quoted 3 lines
If I didn't, then the rules for
tmpreaper_exec_twould never be hit, and in this case the Debian distribution would fail to have a properly labeled/etc/init.d/mountall-bootclean.shscript.
I am not following you here... The above are not rules but file contexts.
And more specifically the above means, only the Debian distribution has mount{all,nfs}-bootclean.sh (and it is located in standard init dir, assumed by refpolicy to be /etc/rc.d/init.d for omogeneity) which would be a wrong location. But then, if the file_contexts.sub_dist file is modified appropriately by the Debian distribution it all comes up as expected, I suppose.
Not very important anyway, just a bit risky I think, unless you're involved with it.
Quoted 6 lines
Wkr,
Sven Vermeulen
_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Regards,
Guido