semanage / file_contexts.local

[Stephen Smalley]

On Wed, 2006-03-29 at 13:39 +0100, Paul Howarth wrote:
> On my FC4 system, I created a file 
> /etc/selinux/targeted/contexts/files/file_contexts.local that contained 
> the following lines:
> 
> /srv/backup(/.*)? system_u:object_r:ftpd_anon_rw_t
> /srv/softlib(/.*)? system_u:object_r:ftpd_anon_rw_t
> 
> This was to ensure that that files created in these areas got the right 
> context, and that it would survive a relabel. Having since learned about 
> customizable types, I probably didn't need to do that in this case, but 
> the principle applies anyway.
> 
> My understanding is that in FC5, the equivalent thing to do for this 
> would be to use semanage to add additional fcontext objects. Is that 
> right (I think the semanage manpage could do with an example or two btw, 
> hint, hint)?

Funny you should ask.  See 
http://marc.theaimsgroup.com/?l=selinux&m=114358806507499&w=2

> My first question is: if I use semanage, is there a convenient way to 
> check, on a running system, which objects are there as part of the base 
> policy and which have been added later, like a file context equivalent 
> of "semodule -l"?

Hmm...doesn't look like semanage presently has an option that invokes
just the xxx_list_local() interface of libsemanage versus the xxx_list()
interface.  Seems like a good idea.

> My second question is: I have lots of log messages like this:
> 
> Mar 26 04:24:39 badby kernel: inode_doinit_with_dentry: 
> context_to_sid(system_u:object_r:ftpd_anon_rw_t) returned 22 for 
> dev=sdb6 ino=96769

Suggests that the type is no longer defined, which seems a bit
surprising.  Usually we add a type alias to keep it valid across
updates.

> /srv/backup(/.*)? system_u:object_r:public_content_rw_t:s0
> /srv/softlib(/.*)? system_u:object_r:public_content_rw_t:s0
> 
> or even deleting it entirely and doing the equivalent with semanage.
> When I do one of these things, when will it take effect? Will I need to 
> reboot, or rebuild policy somehow?

file_contexts.local will still be read by libselinux (matchpathcon), so
it can still be used, but using semanage is likely the better way
forward.  Once you've run the semanage command, it should rebuild and
push out an updated file_contexts file with your additions included, and
then any subsequent runs of restorecon/setfiles/... will make use of
those definitions.  

-- 
Stephen Smalley
National Security Agency