dump/restore (or "star") and SELinux problems

[Kayvan A. Sylvan]

Hi folks,

I am trying again. I haven't gotten an answer that works yet and hoping that
people who know more about SELinux and Fedora can see this and suggest
a solution (or at least a way to investigate).

My goal: To be able to reszie a partition (or rearrange filesystems) without
losing any data or meta-data.

parted is useless, since it won't handle the xattr filesystem data.

I used dump to create a filesystem backup, then used the FC5 Install DVD
to go into rescue mode and restore the dump. That seem to work okay for
the file data. However, for each and every file, I get the message:

    restore: lsetxattr ./filename_being_restored failed: Invalid argument

Using "ls -Z", I see that all the files end up being unlabeled (or they
are in the unlabeled_t context).

These files were all set up in Fedora FC4, using the targeted policy.

When I am booting up using the FC5 Install DVD ("linux rescue"), the SELinux
startup shows:

  security:  3 users, 6 roles, 1161 types, 135 bools, 1 sens, 256 cats
  security:  55 classes, 38679 rules
  SELinux:  Completing initialization.
  SELinux:  Setting up existing superblocks.
  SELinux: initialized (dev loop0, type squashfs), not configured for labeling
  SELinux: initialized (dev usbfs, type usbfs), uses genfs_contexts
  SELinux: initialized (dev ramfs, type ramfs), uses genfs_contexts
  SELinux: initialized (dev ramfs, type ramfs), uses genfs_contexts
  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
  SELinux: initialized (dev debugfs, type debugfs), uses genfs_contexts
  SELinux: initialized (dev selinuxfs, type selinuxfs), uses genfs_contexts
  SELinux: initialized (dev mqueue, type mqueue), uses transition SIDs
  SELinux: initialized (dev hugetlbfs, type hugetlbfs), uses genfs_contexts
  SELinux: initialized (dev devpts, type devpts), uses transition SIDs
  SELinux: initialized (dev eventpollfs, type eventpollfs), uses genfs_contexts
  SELinux: initialized (dev inotifyfs, type inotifyfs), uses genfs_contexts
  SELinux: initialized (dev tmpfs, type tmpfs), uses transition SIDs
  SELinux: initialized (dev futexfs, type futexfs), uses genfs_contexts
  SELinux: initialized (dev pipefs, type pipefs), uses task SIDs
  SELinux: initialized (dev sockfs, type sockfs), uses task SIDs
  SELinux: initialized (dev cpuset, type cpuset), not configured for labeling
  SELinux: initialized (dev proc, type proc), uses genfs_contexts
  SELinux: initialized (dev bdev, type bdev), uses genfs_contexts
  SELinux: initialized (dev rootfs, type rootfs), uses genfs_contexts
  SELinux: initialized (dev sysfs, type sysfs), uses genfs_contexts

I have also tried using "star" with the following args:

  star -v -c -xdev -sparse -acl -link-dirs level=0 -wtardumps \
        f=root.star -C / .

And then, when booted into the rescue mode, did the following to extract:

  star -xpU -restore f=root.star

This produced the same result. The files end up being unlabeled.

I am wondering if I have to have the same SELinux policy loaded while
in the rescue mode in order to avoid the "lsetxattr: invalid argument"
error? How would I go about doing that?

Thanks for any help!

			---Kayvan
-- 
Kayvan A. Sylvan          | Proud husband of       | Father to my kids:
Sylvan Associates, Inc.   | Laura Isabella Sylvan, | Katherine Yelena (8/8/89)
http://sylvan.com/~kayvan | my beautiful Queen.    | Robin Gregory (2/28/92)

[Stephen Smalley]

On Wed, 2006-04-26 at 14:14 -0700, Kayvan A. Sylvan wrote:
>  Hi folks,
>  
>  I am trying again. I haven't gotten an answer that works yet and hoping that
>  people who know more about SELinux and Fedora can see this and suggest
>  a solution (or at least a way to investigate).
>  
>  My goal: To be able to reszie a partition (or rearrange filesystems) without
>  losing any data or meta-data.
>  
>  parted is useless, since it won't handle the xattr filesystem data.
>  
>  I used dump to create a filesystem backup, then used the FC5 Install DVD
>  to go into rescue mode and restore the dump. That seem to work okay for
>  the file data. However, for each and every file, I get the message:
>  
>      restore: lsetxattr ./filename_being_restored failed: Invalid argument
>  
>  Using "ls -Z", I see that all the files end up being unlabeled (or they
>  are in the unlabeled_t context).
>  
>  These files were all set up in Fedora FC4, using the targeted policy. 
Ok, so the problem here is that dump is saving the raw attribute values
(which lack the MLS field since they came from FC4) and then calling
lsetxattr() with those raw attribute values, and the FC5 kernel is then
rejecting them since they lack the field.  Related to:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189845

If restore instead used lsetfilecon(3), the attribute would be extended
appropriately.  Short term workaround for you would be to run restorecon
on the filesystem after restoring it to fix up the labels.

>  I have also tried using "star" with the following args:
>  
>    star -v -c -xdev -sparse -acl -link-dirs level=0 -wtardumps \
>          f=root.star -C / .
>  
>  And then, when booted into the rescue mode, did the following to extract:
>  
>    star -xpU -restore f=root.star 
Did you try following the instructions in the SELinux FAQ:
http://fedora.redhat.com/docs/selinux-faq-fc5/#id2978236

In particular, using -xattr and -H=exustar options.  -acl is specific to
POSIX ACLs I believe.

>  This produced the same result. The files end up being unlabeled.
>  
>  I am wondering if I have to have the same SELinux policy loaded while
>  in the rescue mode in order to avoid the "lsetxattr: invalid argument"
>  error? How would I go about doing that? 
-- 
Stephen Smalley
National Security Agency

[Kayvan A. Sylvan]

Thank you, Stephen, for your helpful answers.

I will try using "star" with -xattr and -Hexustar and report back later
tonight.

On Thu, Apr 27, 2006 at 12:54:57PM -0400, Stephen Smalley wrote:
>  
>  Did you try following the instructions in the SELinux FAQ:
>  http://fedora.redhat.com/docs/selinux-faq-fc5/#id2978236
>  
>  In particular, using -xattr and -H=exustar options.  -acl is specific to
>  POSIX ACLs I believe. 
-- 
Kayvan A. Sylvan          | Proud husband of       | Father to my kids:
Sylvan Associates, Inc.   | Laura Isabella Sylvan, | Katherine Yelena (8/8/89)
http://sylvan.com/~kayvan | my beautiful Queen.    | Robin Gregory (2/28/92)

[Kayvan A. Sylvan]

On Thu, Apr 27, 2006 at 12:54:57PM -0400, Stephen Smalley wrote:
>  
>  Did you try following the instructions in the SELinux FAQ:
>  http://fedora.redhat.com/docs/selinux-faq-fc5/#id2978236
>  
>  In particular, using -xattr and -H=exustar options.  -acl is specific to
>  POSIX ACLs I believe. 
I created the archive using the -xattr and -Hexustar options. With my
system up, I can restore it to a different directory and the files
are correctly labeled.

However, booted into the FC5 rescue mode, I get the following message for
every file:

  star: Can not setup security context for 'testfile'. Not created.

The files end up looking like this afterwards:

# ls -lZ
-rw-r--r--  root     root     system_u:object_r:unlabeled_t    testfile

So, it looks as if using dump/restore or "star", I have the same
inability to preserve security context. This is a practical problem for
me since I am wanting to recreate my partitions using an LVM.

Anyone have any other ideas?

Thanks for all the help so far!!!

			---Kayvan
-- 
Kayvan A. Sylvan          | Proud husband of       | Father to my kids:
Sylvan Associates, Inc.   | Laura Isabella Sylvan, | Katherine Yelena (8/8/89)
http://sylvan.com/~kayvan | my beautiful Queen.    | Robin Gregory (2/28/92)

[Stephen Smalley]

On Thu, 2006-04-27 at 19:19 -0700, Kayvan A. Sylvan wrote:
>  On Thu, Apr 27, 2006 at 12:54:57PM -0400, Stephen Smalley wrote:
>  > 
>  > Did you try following the instructions in the SELinux FAQ:
>  > http://fedora.redhat.com/docs/selinux-faq-fc5/#id2978236
>  > 
>  > In particular, using -xattr and -H=exustar options.  -acl is specific to
>  > POSIX ACLs I believe.
>  
>  I created the archive using the -xattr and -Hexustar options. With my
>  system up, I can restore it to a different directory and the files
>  are correctly labeled.
>  
>  However, booted into the FC5 rescue mode, I get the following message for
>  every file:
>  
>    star: Can not setup security context for 'testfile'. Not created.
>  
>  The files end up looking like this afterwards:
>  
>  # ls -lZ
>  -rw-r--r--  root     root     system_u:object_r:unlabeled_t    testfile
>  
>  So, it looks as if using dump/restore or "star", I have the same
>  inability to preserve security context. This is a practical problem for
>  me since I am wanting to recreate my partitions using an LVM.
>  
>  Anyone have any other ideas?
>  
>  Thanks for all the help so far!!! 
Can you add a comment to the existing bugzilla report for dump/restore,
and add a new bug for star with this information, please?  Thanks.

-- 
Stephen Smalley
National Security Agency

[Tony Nelson]

At 7:37 AM -0400 4/28/06, Stephen Smalley wrote:
> On Thu, 2006-04-27 at 19:19 -0700, Kayvan A. Sylvan wrote:
> > On Thu, Apr 27, 2006 at 12:54:57PM -0400, Stephen Smalley wrote:
> > >
> > > Did you try following the instructions in the SELinux FAQ:
> > > http://fedora.redhat.com/docs/selinux-faq-fc5/#id2978236
> > >
> > > In particular, using -xattr and -H=exustar options.  -acl is specific to
> > > POSIX ACLs I believe.
> >
> > I created the archive using the -xattr and -Hexustar options. With my
> > system up, I can restore it to a different directory and the files
> > are correctly labeled.
> >
> > However, booted into the FC5 rescue mode, I get the following message for
> > every file:
> >
> >   star: Can not setup security context for 'testfile'. Not created.
> >
> > The files end up looking like this afterwards:
> >
> > # ls -lZ
> > -rw-r--r--  root     root     system_u:object_r:unlabeled_t    testfile
> >
> > So, it looks as if using dump/restore or "star", I have the same
> > inability to preserve security context. This is a practical problem for
> > me since I am wanting to recreate my partitions using an LVM.
> >
> > Anyone have any other ideas?
> >
> > Thanks for all the help so far!!!
>
> Can you add a comment to the existing bugzilla report for dump/restore,
> and add a new bug for star with this information, please?  Thanks. 
BTW, the dump bug is bug #189845
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189845
____________________________________________________________________
TonyN.:'                       <mailto:[e-mail]>
      '                              <http://www.georgeanelson.com/>