What's the proper way to set context on locally installed files?

[Jason L Tibbitts III]

Matlab, it seems, puts shared libs and binaries in the same
directory.  I will freely admit that Matlab is a piece of crap, but I
have no choice but to support it.

Until recent policy updates the location of the libraries was not an
issue, but under selinux-policy-targeted-1.17.30-3.15 Matlab fails to
start at all because it can't load its libraries.  On my system they
live under /usr/lib/matlab-14.2/bin/glnx86, and I suppose due to that
they end up with system_u:object_r:bin_t context.  If I do

chcon system_u:object_r:shlib_t /usr/lib/matlab-14.2/bin/glnx86/*.so

everything is happy.

I'm going to see if I can hack Matlab to look for its libraries
elsewhere, but if I can't I wonder if there's any way for me to
include local file context overrides for things like this.

 - J<

[Stephen Smalley]

On Thu, 2005-06-30 at 10:04 -0500, Jason L Tibbitts III wrote:
>  Matlab, it seems, puts shared libs and binaries in the same
>  directory.  I will freely admit that Matlab is a piece of crap, but I
>  have no choice but to support it.
>  
>  Until recent policy updates the location of the libraries was not an
>  issue, but under selinux-policy-targeted-1.17.30-3.15 Matlab fails to
>  start at all because it can't load its libraries.  On my system they
>  live under /usr/lib/matlab-14.2/bin/glnx86, and I suppose due to that
>  they end up with system_u:object_r:bin_t context.  If I do
>  
>  chcon system_u:object_r:shlib_t /usr/lib/matlab-14.2/bin/glnx86/*.so
>  
>  everything is happy.
>  
>  I'm going to see if I can hack Matlab to look for its libraries
>  elsewhere, but if I can't I wonder if there's any way for me to
>  include local file context overrides for things like this. 
In FC4, there is an
optional /etc/selinux/targeted/contexts/files/file_contexts.local file
that can be created for local overrides.  I don't think that support is
in FC3, unless they back port the corresponding changes to
matchpathcon/setfiles.

-- 
Stephen Smalley
National Security Agency