commit: bcac54411c462aa59fe874325e4843f61dc71312 Author: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be> AuthorDate: Sun Nov 23 16:10:50 2014 +0000 Commit: Zac Medico <zmedico <AT> gentoo <DOT> org> CommitDate: Wed Nov 26 08:38:14 2014 +0000 URL: http://sources.gentoo.org/gitweb/?p=proj/portage.git;a=commit;h=bcac5441
Force the SELinux user during relabel operation (530192) When Portage relabels the files of the package, it currently calls setfiles (which is correct) but does not use the -F option (force). As a result, the files only get assigned the right SELinux type, but not the right SELinux user and SELinux role. By using "setfiles -F", the SELinux user (and role, but role almost always remains "object_r") is set to the right one (system_u mostly). Without this, a multi-user system with different SELinux users and with User Based Access Control (UBAC) enabled (the local "ubac" USE flag) might find that some software fails to work for different SELinux users than the one used to install the software, until a full forced relabel operation is done. X-Gentoo-Bug: 530192 X-Gentoo-Url: https://bugs.gentoo.org/show_bug.cgi?id=530192 Acked-by: Zac Medico <zmedico <AT> gentoo.org> --- bin/misc-functions.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/misc-functions.sh b/bin/misc-functions.sh index 6e6fcb4..8d5df78 100755 --- a/bin/misc-functions.sh +++ b/bin/misc-functions.sh @@ -392,7 +392,7 @@ preinst_selinux_labels() { addwrite /selinux/context addwrite /sys/fs/selinux/context - /usr/sbin/setfiles "${file_contexts_path}" -r "${D}" "${D}" + /usr/sbin/setfiles -F "${file_contexts_path}" -r "${D}" "${D}" ) || die "Failed to set SELinux security labels." else # nonfatal, since merging can happen outside a SE kernel
