Jira (PUP-6071) Wrong selinux type for files in symlinked directories

[Thomas Mueller (JIRA)]

Title: Message Title

Thomas Mueller created an issue   Puppet / PUP-6071 Wrong selinux type for files in symlinked directories Issue Type: Bug Affects Versions: PUP 4.4.0, PUP 3.8.6 Assignee: Eric Sorenson Components: Community Created: 2016/03/18 12:04 AM Environment: Linux with SELinux enabled Priority: Normal Reporter: Thomas Mueller matchpathcon does only act on the passed string and not resolve the real path problematic if puppet manages /etc/init.d/script on RHEL which symlinks /etc/init.d to /etc/rc.d/init.d. matchpathcon will return the wrong label. This mimics restorecon behaviour. Example restorecon vs. matchpathcon [root@el6 util]# matchpathcon /etc/init.d/sshd /etc/init.d/sshd system_u:object_r:initrc_exec_t:s0 [root@el6 util]# matchpathcon /etc/rc.d/init.d/sshd /etc/rc.d/init.d/sshd system_u:object_r:sshd_initrc_exec_t:s0   [root@el6 util]# ls -lZ /etc/init.d/sshd -rwxr-xr-x. root root system_u:object_r:initrc_exec_t:s0 /etc/init.d/sshd [root@el6 util]# restorecon -v /etc/init.d/sshd restorecon reset /etc/rc.d/init.d/sshd context system_u:object_r:initrc_exec_t:s0->system_u:object_r:sshd_initrc_exec_t:s0 Possible problems fixing this users maybe have added wrong selinux fcontext rules. If puppet now applies the new "correct" type it's maybe not wrongly configured one Add Comment   This message was sent by Atlassian JIRA (v6.4.12#64027-sha1:e3691cc) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.