SELinux contexts

[Paolo Galtieri]

On 07/31/2014 11:28 AM, Daniel J Walsh wrote:
> On 07/31/2014 01:52 PM, Paolo Galtieri wrote:
>> On 07/31/2014 09:51 AM, Michael Cronenworth wrote:
>>> On 07/31/2014 10:54 AM, pgaltieri . wrote:
>>>> sudo semanage fcontext -a -t var_log_t 'logs'
>>> [snip]
>>>
>>> You need to pass the full path here.
>>>
>>> # semanage fcontext -a -t var_log_t /media/NSM/NSM-SENSOR-2/logs
>>>
>> I tried that and the restorecon and the file type is still file_t
>> instead of var_log_t.
>>
>> Paolo
> # semanage fcontext -a -t var_log_t '/media/NSM/NSM-SENSOR-2/logs(/.*)?'
> # restorecon -R -v /media/NSM/NSM-SENSOR-2
>
> Should change labels.
>
What's interesting is if I do

semanage fcontext -a -t snort_log_t /media/NSM/NSM-SENSOR-2/logs

restorecon -v /media/NSM/NSM-SENSOR-2/logs

restorecon reset /media/NSM/NSM-SENSOR-2/logs context unconfined_u:object_r:file_t:s0->unconfined_u:object_r:snort_log_t:s0

ll -Zd /media/NSM/NSM-SENSOR-2/logs

drwxr-xr-x. snort snort unconfined_u:object_r:snort_log_t:s0 
/media/NSM/NSM-SENSOR-2/logs

so it worked in this case.  Now if I do the same thing, but using 
var_log_t as the FILE_TYPE it works.

Is it possible that the error about no default label is what is 
preventing me from changing the context the first time I tried? Since I 
didn't get the error when I changed the context to snort_log_t 
restorecon changed it and now SELinux thinks there is a default label 
(snort_log_t).  Subsequent changes work because of the presence of a  
default label.

Paolo