[PATCH] policycoreutils/fixfiles: do not dereference link files in tmp

[PATCH] policycoreutils/fixfiles: do not dereference link files in tmp

[Vit Mojzis]

Files in /tmp, /var/tmp, /var/run and /var/lib/debug labeled as
unlabeled_t or undefined_t are relabeled to match corresponding
directory label. Stop dereferencing link files in these folders
in order not to accidentally change label of other files in the
system.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1458831

Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
 policycoreutils/scripts/fixfiles | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index 0eeeea4..1aa330f 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -255,10 +255,10 @@ case "$RESTORE_MODE" in
 	UNDEFINED=`get_undefined_type` || exit $?
 	UNLABELED=`get_unlabeled_type` || exit $?
 	find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) \( -type s -o -type p \) -delete
-	find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /tmp {} \;
-	find /var/tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /var/tmp {} \;
-	find /var/run \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /var/run {} \;
-	[ ! -e /var/lib/debug ] || find /var/lib/debug \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --reference /lib {} \;
+	find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /tmp {} \;
+	find /var/tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/tmp {} \;
+	find /var/run \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/run {} \;
+	[ ! -e /var/lib/debug ] || find /var/lib/debug \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /lib {} \;
     ;;
 esac
 }
-- 
2.9.4

Re: [PATCH] policycoreutils/fixfiles: do not dereference link files in tmp

[Stephen Smalley]

On Fri, 2017-06-16 at 10:29 +0200, Vit Mojzis wrote:
> Files in /tmp, /var/tmp, /var/run and /var/lib/debug labeled as
> unlabeled_t or undefined_t are relabeled to match corresponding
> directory label. Stop dereferencing link files in these folders
> in order not to accidentally change label of other files in the
> system.
> 
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1458831
> 
> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>

Thanks, applied.

> ---
>  policycoreutils/scripts/fixfiles | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/policycoreutils/scripts/fixfiles
> b/policycoreutils/scripts/fixfiles
> index 0eeeea4..1aa330f 100755
> --- a/policycoreutils/scripts/fixfiles
> +++ b/policycoreutils/scripts/fixfiles
> @@ -255,10 +255,10 @@ case "$RESTORE_MODE" in
>  	UNDEFINED=`get_undefined_type` || exit $?
>  	UNLABELED=`get_unlabeled_type` || exit $?
>  	find /tmp \( -context "*:${UNLABELED}*" -o -context
> "*:${UNDEFINED}*" \) \( -type s -o -type p \) -delete
> -	find /tmp \( -context "*:${UNLABELED}*" -o -context
> "*:${UNDEFINED}*" \) -exec chcon --reference /tmp {} \;
> -	find /var/tmp \( -context "*:${UNLABELED}*" -o -context
> "*:${UNDEFINED}*" \) -exec chcon --reference /var/tmp {} \;
> -	find /var/run \( -context "*:${UNLABELED}*" -o -context
> "*:${UNDEFINED}*" \) -exec chcon --reference /var/run {} \;
> -	[ ! -e /var/lib/debug ] || find /var/lib/debug \( -context
> "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --
> reference /lib {} \;
> +	find /tmp \( -context "*:${UNLABELED}*" -o -context
> "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /tmp {}
> \;
> +	find /var/tmp \( -context "*:${UNLABELED}*" -o -context
> "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference
> /var/tmp {} \;
> +	find /var/run \( -context "*:${UNLABELED}*" -o -context
> "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference
> /var/run {} \;
> +	[ ! -e /var/lib/debug ] || find /var/lib/debug \( -context
> "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-
> dereference --reference /lib {} \;
>      ;;
>  esac
>  }