setting files attributes
I had an experience yesterday which has given me pause for thought. I was
working with Dan Walsh to get the policy correct to run the X after the
xorg-x11-* update which renamed a lot of things including
/usr/X11R6/bin/XFree86 -> /usr/X11R6/bin/Xorg. After installing the updated
packages (which should be in development/rawhide later today), he informed me
I needed to run the following:
restorecon /usr/bin/X11/Xorg
restorecon /var/log/Xorg*
and I dutifully did that.
Then I tried to do "telinit 5" with enforcing=1 again and, again, the X server
startup failed.
After some looking around I came to realize the following:
The path specified makes a difference. The full path specified in policy is
/usr/X11R6/bin/Xorg where I was using /usr/bin/X11/Xorg. The result of
restorecon /usr/bin/X11/Xorg
is
-rws--x--x+ root root system_u:object_r:bin_t \
/usr/bin/X11/Xorg
whereas the result of running
restorecon /usr/X11R6/Xorg
is
-rws--x--x+ root root system_u:object_r:xserver_exec_t
/usr/bin/X11/Xorg
OK, besides sending this message to give folks some warning when they install
the new xor-x11-* and the new policy (1.11.2-3 or later) is that I do not
complete understand what is done when I do a system wide relabel.
What make -C /etc/security/selinux/src/policy/ relabel appears to do is to go
through the all mounted filesystems and set the attributes depending on the
rules it has. The question is, does it follow symbolic links or not. If it
does not, then there should not be a problem as long as all of the policy
rules always use the actual (non-symbolic-link) path AND make sure we do also
if we do something manually.
However, I can see a problem occurring if it does follow symbolic links
because the process likely occurs in sorted order. Now /tmp is clears (or so
it says and, I hope, that means /var/tmp/ also), so I should not be able to
rename /usr/X11R6/bin/Xorg. However, what if I had a symbolic link from my
home directory to something in /etc. Would that get mislabeled?
Gene