Finding unlabeled files?

[Tom London]

I used the following to find files that are not labeled:

     find / -context 'null' -print  2>&1 | grep 'No data
available'

This prints out error messages of the form:
    getfilecon(/var/spool/cron/mailman): No data available
    getfilecon(/var/spool/at/.SEQ): No data available
    getfilecon(/initrd): No data available
    getfilecon(/initrd/sys): No data available
    getfilecon(/initrd/sbin): No data available
    getfilecon(/initrd/linuxrc): No data available
etc.

Is there a better/proper way of doing this?  (If not, perhaps I'll write 
one...)

The situation comes up when converting a system to SELinux, or if you 
accidently boot up an SELinux system in 'disabled' mode. 

I understand its 'safer' to run 'fixfiles relabel', but some vestigial 
unlabeled files seem to remain...

Thanks,
   tom

Finding unlabeled files? (not selinux-enabled?)

[Bob Gustafson]

Hmm, what means this?

  [root@hoho2 root]# find / -context 'null' -print
  find: Error: invalid predicate -context: the kernel is not selinux-enabled.

[root@hoho2 root]# od -c /selinux/enforce
0000000   0
0000001
[root@hoho2 root]#

The boot param was set to 'selinux=1 enforcing=0' and I have lots of good
looking SELinux lines in the /var/log/messages.1 file:

[root@hoho2 log]# grep SELinux messages.1
...
May 30 00:09:17 hoho2 kernel: SELinux:  Initializing.
May 30 00:09:17 hoho2 kernel: SELinux:  Starting in permissive mode
May 30 00:09:18 hoho2 kernel: SELinux:  Registering netfilter hooks
[root@hoho2 log]# date
Sun May 30 15:46:43 CDT 2004
[root@hoho2 log]# uptime
 15:46:45 up 15:38,  3 users,  load average: 0.00, 0.00, 0.00
[root@hoho2 log]#


[root@hoho2 root]# cat /proc/version
Linux version 2.6.6-1.397smp (bhcompile(a)tweety.build.redhat.com) (gcc
version 3.
3.3 20040412 (Red Hat Linux 3.3.3-7)) #1 SMP Fri May 28 11:34:11 EDT 2004
[root@hoho2 root]#

BobG

On Sun, 30 May 2004 11:11:52 -0700, Tom London wrote:
> I used the following to find files that are not labeled:
>
>      find / -context 'null' -print  2>&1 | grep 'No data
> available'
>
> This prints out error messages of the form:
>     getfilecon(/var/spool/cron/mailman): No data available
>     getfilecon(/var/spool/at/.SEQ): No data available
>     getfilecon(/initrd): No data available
>     getfilecon(/initrd/sys): No data available
>     getfilecon(/initrd/sbin): No data available
>     getfilecon(/initrd/linuxrc): No data available
> etc.
>
> Is there a better/proper way of doing this?  (If not, perhaps I'll write
> one...)
>
> The situation comes up when converting a system to SELinux, or if you
> accidently boot up an SELinux system in 'disabled' mode.
>
> I understand its 'safer' to run 'fixfiles relabel', but some vestigial
> unlabeled files seem to remain...
>
> Thanks,
>    tom

[Thomas Bleher]

* Tom London <selinux(a)comcast.net&gt; [2004-05-30 20:12]:
>  I understand its 'safer' to run 'fixfiles relabel',
> but some vestigial 
>  unlabeled files seem to remain... 
Look into your policy for file contexts which specify "<<none>>" 
as
context. This means that setfiles does not touch these files at all, as
they can not be properly labeled by looking at the file name; so it is
best to leave them alone.
If you come from a non-SELinux system you should probably delete all
these files[0] and reboot.

Thomas

[0] the policy I'm looking right now has <<none>> only for files which
can be safely deleted if the system is in single user mode and is
restarted immediately afterwards.

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7