On Wed, 2006-03-29 at 13:39 +0100, Paul Howarth wrote:
On my FC4 system, I created a file
/etc/selinux/targeted/contexts/files/file_contexts.local that contained
the following lines:
/srv/backup(/.*)? system_u:object_r:ftpd_anon_rw_t
/srv/softlib(/.*)? system_u:object_r:ftpd_anon_rw_t
This was to ensure that that files created in these areas got the right
context, and that it would survive a relabel. Having since learned about
customizable types, I probably didn't need to do that in this case, but
the principle applies anyway.
My understanding is that in FC5, the equivalent thing to do for this
would be to use semanage to add additional fcontext objects. Is that
right (I think the semanage manpage could do with an example or two btw,
hint, hint)?
Funny you should ask. See
http://marc.theaimsgroup.com/?l=selinux&m=114358806507499&w=2
My first question is: if I use semanage, is there a convenient way to
check, on a running system, which objects are there as part of the base
policy and which have been added later, like a file context equivalent
of "semodule -l"?
Hmm...doesn't look like semanage presently has an option that invokes
just the xxx_list_local() interface of libsemanage versus the xxx_list()
interface. Seems like a good idea.
My second question is: I have lots of log messages like this:
Mar 26 04:24:39 badby kernel: inode_doinit_with_dentry:
context_to_sid(system_u:object_r:ftpd_anon_rw_t) returned 22 for
dev=sdb6 ino=96769
Suggests that the type is no longer defined, which seems a bit
surprising. Usually we add a type alias to keep it valid across
updates.
/srv/backup(/.*)? system_u:object_r:public_content_rw_t:s0
/srv/softlib(/.*)? system_u:object_r:public_content_rw_t:s0
or even deleting it entirely and doing the equivalent with semanage.
When I do one of these things, when will it take effect? Will I need to
reboot, or rebuild policy somehow?
file_contexts.local will still be read by libselinux (matchpathcon), so
it can still be used, but using semanage is likely the better way
forward. Once you've run the semanage command, it should rebuild and
push out an updated file_contexts file with your additions included, and
then any subsequent runs of restorecon/setfiles/... will make use of
those definitions.
--
Stephen Smalley
National Security Agency