Your message dated Tue, 25 Aug 2009 10:56:44 +0200
with message-id <[email protected]>
and subject line Re: Bug#543419: policycoreutils: setfiles does not relabel
with target=/
has caused the Debian Bug report #543419,
regarding policycoreutils: setfiles does not relabel with target=/
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
543419: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543419
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: policycoreutils
Version: 2.0.69-2
Severity: important
On my (freshly installed) unstable system I don't get a relabeling when
executing `fixfiles relabel'. This is caused by passing "/" as the pathname to
setfiles:
+ echo 'Relabeling / /home/pkern/src/kernel'
Relabeling / /home/pkern/src/kernel
+ /sbin/setfiles -p -q -l /etc/selinux/default/contexts/files/file_contexts /
/home/pkern/src/kernel
(/home/pkern/src/kernel being the other normal filesystem apart from the root
FS being mounted.)
Now if I execute setfiles with a bit less quietness I get this:
simplex:~# /sbin/setfiles -n -vv -l
/etc/selinux/default/contexts/files/file_contexts /
simplex:~#
However, if I try a directory below / I get:
simplex:~# /sbin/setfiles -n -vv -l
/etc/selinux/default/contexts/files/file_contexts /bin | head -n 5
/sbin/setfiles reset /bin context ->system_u:object_r:bin_t:s0
/sbin/setfiles reset /bin/chmod context ->system_u:object_r:bin_t:s0
/sbin/setfiles reset /bin/false context ->system_u:object_r:bin_t:s0
/sbin/setfiles reset /bin/tempfile context ->system_u:object_r:bin_t:s0
/sbin/setfiles reset /bin/mknod context ->system_u:object_r:bin_t:s0
So there's clearly something wrong here. The contents of /proc/mounts for
reference:
rootfs / rootfs rw 0 0
none /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0
none /proc proc rw,nosuid,nodev,noexec,relatime 0 0
udev /dev tmpfs rw,relatime,size=10240k,mode=755 0 0
/dev/mapper/simplex-debian--root / ext4
rw,relatime,errors=remount-ro,barrier=1,data=ordered 0 0
tmpfs /lib/init/rw tmpfs rw,nosuid,relatime,mode=755 0 0
varrun /var/run tmpfs rw,nosuid,relatime,mode=755 0 0
varlock /var/lock tmpfs rw,nosuid,nodev,noexec,relatime 0 0
tmpfs /dev/shm tmpfs rw,nosuid,nodev,relatime 0 0
devpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0
/dev/mapper/simplex-kernel /home/pkern/src/kernel btrfs rw,noatime 0 0
tmpfs /tmp tmpfs rw,relatime,size=786432k 0 0
binfmt_misc /proc/sys/fs/binfmt_misc binfmt_misc
rw,nosuid,nodev,noexec,relatime 0 0
(Plus a /selinux mount which I had to add to fstab manually because it didn't
pop up after the boot but which doesn't show up because the instance I'm
currently filing the bug on missed the selinux=1 flag on boot.)
-- System Information:
Debian Release: squeeze/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.31-rc6-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages policycoreutils depends on:
ii libc6 2.9-25 GNU C Library: Shared libraries
ii libpam0g 1.0.1-11 Pluggable Authentication Modules l
ii libselinux1 2.0.85-2 SELinux shared libraries
ii libsemanage1 2.0.33-2 shared libraries used by SELinux p
ii libsepol1 2.0.37-1 Security Enhanced Linux policy lib
ii python 2.5.4-2 An interactive high-level object-o
ii python-selinux 2.0.85-2 Python bindings to SELinux shared
ii python-semanage 2.0.33-2 Python bindings for SELinux polic
ii python-sepolgen 1.0.17-2 A Python module used in SELinux po
Versions of packages policycoreutils recommends:
ii selinux-policy-default 2:0.2.20090730-2 Strict and Targeted variants of th
policycoreutils suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
On Mon, Aug 24, 2009 at 11:36:10PM +0200, Philipp Kern wrote:
> simplex:~# /sbin/setfiles -n -vv -l
> /etc/selinux/default/contexts/files/file_contexts /
> simplex:~#
Gah, ok. So for this to work you have to boot with selinux=1, otherwise
it's guaranteed not to work. The relabeling did fail on my primary machine
but as it rebooted too quickly afterwards I wasn't able to investigate it.
It works in the virtual machine, though and shows the correct behaviour
then. Sorry for the noise.
I'll try to confine me to that pristine VM with sysvinit and Debian's defaults.
Please keep up with your good work wrt SELinux.
Kind regards,
Philipp Kern
--
.''`. Philipp Kern Debian Developer
: :' : http://philkern.de Stable Release Manager
`. `' xmpp:[email protected] Wanna-Build Admin
`- finger pkern/[email protected]
signature.asc
Description: Digital signature
--- End Message ---
