Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-13 Thread Alan Jenkins
On 13/01/17 19:56, Alan Jenkins wrote: On 13/01/17 19:38, Stephen Smalley wrote: On Fri, 2017-01-13 at 13:29 -0500, Daniel J Walsh wrote: On 01/13/2017 10:27 AM, Stephen Smalley wrote: On Fri, 2017-01-13 at 09:48 -0500, Stephen Smalley wrote: On Thu, 2017-01-12 at 23:42 +, Alan Jenkins wr

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-13 Thread Alan Jenkins
On 13/01/17 19:38, Stephen Smalley wrote: On Fri, 2017-01-13 at 13:29 -0500, Daniel J Walsh wrote: On 01/13/2017 10:27 AM, Stephen Smalley wrote: On Fri, 2017-01-13 at 09:48 -0500, Stephen Smalley wrote: On Thu, 2017-01-12 at 23:42 +, Alan Jenkins wrote: My main puzzle here[*] is why `fix

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-13 Thread Stephen Smalley
On Fri, 2017-01-13 at 13:29 -0500, Daniel J Walsh wrote: > > On 01/13/2017 10:27 AM, Stephen Smalley wrote: > > > > On Fri, 2017-01-13 at 09:48 -0500, Stephen Smalley wrote: > > > > > > On Thu, 2017-01-12 at 23:42 +, Alan Jenkins wrote: > > > > > > > > My main puzzle here[*] is why `fixfile

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-13 Thread Daniel J Walsh
On 01/13/2017 10:27 AM, Stephen Smalley wrote: > On Fri, 2017-01-13 at 09:48 -0500, Stephen Smalley wrote: >> On Thu, 2017-01-12 at 23:42 +, Alan Jenkins wrote: >>> My main puzzle here[*] is why `fixfiles` handles sysfs (/sys/) >>> fine, >>> but >>> then there's floods of warnings about debu

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-13 Thread Stephen Smalley
On Thu, 2017-01-12 at 20:47 +, Alan Jenkins wrote: > Perhaps the root cause is actually the same.  I still prefer the > messages from fixfiles though.  It explicitly detected conflicting > labels on hardlinks > > https://bugzilla.redhat.com/show_bug.cgi?id=1411371 On this topic, I have opened

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-13 Thread Stephen Smalley
On Fri, 2017-01-13 at 09:48 -0500, Stephen Smalley wrote: > On Thu, 2017-01-12 at 23:42 +, Alan Jenkins wrote: > > > > My main puzzle here[*] is why `fixfiles` handles sysfs (/sys/) > > fine, > > but  > > then there's floods of warnings about debugfs > > (/sys/kernel/debug/).  The  > > same se

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-13 Thread Stephen Smalley
On Thu, 2017-01-12 at 23:42 +, Alan Jenkins wrote: > My main puzzle here[*] is why `fixfiles` handles sysfs (/sys/) fine, > but  > then there's floods of warnings about debugfs > (/sys/kernel/debug/).  The  > same seems to happen with /dev/ being fine, but not the other > virtual  > fs's with s

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-13 Thread Alan Jenkins
On 12/01/17 21:23, Stephen Smalley wrote: On Thu, 2017-01-12 at 20:47 +, Alan Jenkins wrote: On 12/01/17 20:01, Stephen Smalley wrote: On Wed, 2017-01-11 at 12:41 +, Alan Jenkins wrote: fixfiles links to restorecon. However if you start with restorecon "restore file(s) default SELinux

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-12 Thread Stephen Smalley
On Thu, 2017-01-12 at 20:47 +, Alan Jenkins wrote: > On 12/01/17 20:01, Stephen Smalley wrote: > > On Wed, 2017-01-11 at 12:41 +, Alan Jenkins wrote: > > > fixfiles links to restorecon.  However if you start with > > > restorecon > > > "restore file(s) default SELinux security contexts", yo

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-12 Thread Alan Jenkins
On 12/01/17 20:01, Stephen Smalley wrote: On Wed, 2017-01-11 at 12:41 +, Alan Jenkins wrote: fixfiles links to restorecon. However if you start with restorecon "restore file(s) default SELinux security contexts", you can easily miss the fixfiles script. fixfiles is more generally useful th

Re: [PATCH] restorecon manpage: link back to fixfiles

2017-01-12 Thread Stephen Smalley
On Wed, 2017-01-11 at 12:41 +, Alan Jenkins wrote: > fixfiles links to restorecon.  However if you start with restorecon > "restore file(s) default SELinux security contexts", you can easily > miss the fixfiles script.  fixfiles is more generally useful than > `restorecon -R`.   For example `re