SELinux file context matching

SELinux file context matching

[Mark Steele]

[-- Attachment #1: Type: text/plain, Size: 1142 bytes --]

Hi list,

I've got some file contexts setup for an application, and can't get the
file context matching to work as I would expect.

[root@dev1 policy]# cat /etc/selinux/targeted/contexts/files/file_contexts
| grep cinched
/etc/cinched(/.*)?      system_u:object_r:ts_etc_t:s0
/var/log/cinched(/.*)?  system_u:object_r:ts_log_t:s0
/var/lib/cinched(/.*)?  system_u:object_r:ts_t:s0
*/usr/lib64/cinched(/.*)?        system_u:object_r:ts_lib_t:s0*
/etc/bash_completion.d/cinched_bash_completions
system_u:object_r:ts_etc_t:s0
/var/log/cinched/audit(/.*)?    system_u:object_r:ts_audit_log_t:s0
/usr/sbin/cinched       system_u:object_r:ts_exec_t:s0

[root@dev1 policy]# matchpathcon /usr/lib64/cinched/
*/usr/lib64/cinched      system_u:object_r:lib_t:s0*

[root@dev1 policy]# findcon
/etc/selinux/targeted/contexts/files/file_contexts -p /usr/lib64/cinched
/.*             system_u:object_r:default_t:s0
/usr/.*         system_u:object_r:usr_t:s0
*/usr/lib64/cinched(/.*)?                system_u:object_r:ts_lib_t:s0*


This is running on CentOS 7. I was assuming that since my rule has the
longest stem, it would be applied.

Any suggestions?

[-- Attachment #2: Type: text/html, Size: 1717 bytes --]

Re: SELinux file context matching

[Stephen Smalley]

On 02/02/2016 12:48 PM, Mark Steele wrote:
> Hi list,
>
> I've got some file contexts setup for an application, and can't get the
> file context matching to work as I would expect.
>
> [root@dev1 policy]# cat
> /etc/selinux/targeted/contexts/files/file_contexts | grep cinched
> /etc/cinched(/.*)?      system_u:object_r:ts_etc_t:s0
> /var/log/cinched(/.*)?  system_u:object_r:ts_log_t:s0
> /var/lib/cinched(/.*)?  system_u:object_r:ts_t:s0
> */usr/lib64/cinched(/.*)?        system_u:object_r:ts_lib_t:s0*
> /etc/bash_completion.d/cinched_bash_completions
> system_u:object_r:ts_etc_t:s0
> /var/log/cinched/audit(/.*)?    system_u:object_r:ts_audit_log_t:s0
> /usr/sbin/cinched       system_u:object_r:ts_exec_t:s0
>
> [root@dev1 policy]# matchpathcon /usr/lib64/cinched/
> */usr/lib64/cinched      system_u:object_r:lib_t:s0*
>
> [root@dev1 policy]# findcon
> /etc/selinux/targeted/contexts/files/file_contexts -p /usr/lib64/cinched
> /.*             system_u:object_r:default_t:s0
> /usr/.*         system_u:object_r:usr_t:s0
> */usr/lib64/cinched(/.*)?                system_u:object_r:ts_lib_t:s0*
>
>
> This is running on CentOS 7. I was assuming that since my rule has the
> longest stem, it would be applied.
>
> Any suggestions?

It would help to see the complete file_contexts file.
Do you have anything in file_contexts.local that could be overriding it?

Re: SELinux file context matching

[Jason Zaman]

On Tue, Feb 02, 2016 at 01:15:51PM -0500, Stephen Smalley wrote:
> On 02/02/2016 12:48 PM, Mark Steele wrote:
> > Hi list,
> >
> > I've got some file contexts setup for an application, and can't get the
> > file context matching to work as I would expect.
> >
> > [root@dev1 policy]# cat
> > /etc/selinux/targeted/contexts/files/file_contexts | grep cinched
> > /etc/cinched(/.*)?      system_u:object_r:ts_etc_t:s0
> > /var/log/cinched(/.*)?  system_u:object_r:ts_log_t:s0
> > /var/lib/cinched(/.*)?  system_u:object_r:ts_t:s0
> > */usr/lib64/cinched(/.*)?        system_u:object_r:ts_lib_t:s0*
> > /etc/bash_completion.d/cinched_bash_completions
> > system_u:object_r:ts_etc_t:s0
> > /var/log/cinched/audit(/.*)?    system_u:object_r:ts_audit_log_t:s0
> > /usr/sbin/cinched       system_u:object_r:ts_exec_t:s0
> >
> > [root@dev1 policy]# matchpathcon /usr/lib64/cinched/
> > */usr/lib64/cinched      system_u:object_r:lib_t:s0*
> >
> > [root@dev1 policy]# findcon
> > /etc/selinux/targeted/contexts/files/file_contexts -p /usr/lib64/cinched
> > /.*             system_u:object_r:default_t:s0
> > /usr/.*         system_u:object_r:usr_t:s0
> > */usr/lib64/cinched(/.*)?                system_u:object_r:ts_lib_t:s0*
> >
> >
> > This is running on CentOS 7. I was assuming that since my rule has the
> > longest stem, it would be applied.
> >
> > Any suggestions?
> 
> It would help to see the complete file_contexts file.
> Do you have anything in file_contexts.local that could be overriding it?

Also, file_contexts.subs*. /usr/lib64 and 32 are usually aliased to
/usr/lib so your fcontexts needs to be /usr/lib/cinched(/.*)? instead of
with the 64.

Re: SELinux file context matching

[Mike Palmiotto]

On Tue, Feb 2, 2016 at 1:15 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 02/02/2016 12:48 PM, Mark Steele wrote:
>>
>> Hi list,
>>
>> I've got some file contexts setup for an application, and can't get the
>> file context matching to work as I would expect.
>>
>> [root@dev1 policy]# cat
>> /etc/selinux/targeted/contexts/files/file_contexts | grep cinched
>> /etc/cinched(/.*)?      system_u:object_r:ts_etc_t:s0
>> /var/log/cinched(/.*)?  system_u:object_r:ts_log_t:s0
>> /var/lib/cinched(/.*)?  system_u:object_r:ts_t:s0
>> */usr/lib64/cinched(/.*)?        system_u:object_r:ts_lib_t:s0*
>> /etc/bash_completion.d/cinched_bash_completions
>> system_u:object_r:ts_etc_t:s0
>> /var/log/cinched/audit(/.*)?    system_u:object_r:ts_audit_log_t:s0
>> /usr/sbin/cinched       system_u:object_r:ts_exec_t:s0
>>
>> [root@dev1 policy]# matchpathcon /usr/lib64/cinched/
>> */usr/lib64/cinched      system_u:object_r:lib_t:s0*
>>
>> [root@dev1 policy]# findcon
>> /etc/selinux/targeted/contexts/files/file_contexts -p /usr/lib64/cinched
>> /.*             system_u:object_r:default_t:s0
>> /usr/.*         system_u:object_r:usr_t:s0
>> */usr/lib64/cinched(/.*)?                system_u:object_r:ts_lib_t:s0*
>>
>>
>> This is running on CentOS 7. I was assuming that since my rule has the
>> longest stem, it would be applied.
>>
>> Any suggestions?
>
>
> It would help to see the complete file_contexts file.
> Do you have anything in file_contexts.local that could be overriding it?

Also, it looks like file_context.subs_dist has the entry: '/usr/lib64
/usr/lib' on CentOS 7. Perhaps Mark's file entries should instead be
using /usr/lib/cinched?

--Mike

Re: SELinux file context matching

[Mark Steele]

[-- Attachment #1: Type: text/plain, Size: 1930 bytes --]

Thanks guys, I forgot to check the _dist file, switching to /usr/lib did
the trick.

Cheers,

Mark

On Tue, Feb 2, 2016 at 1:31 PM, Mike Palmiotto <
mike.palmiotto@crunchydata.com> wrote:

> On Tue, Feb 2, 2016 at 1:15 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> > On 02/02/2016 12:48 PM, Mark Steele wrote:
> >>
> >> Hi list,
> >>
> >> I've got some file contexts setup for an application, and can't get the
> >> file context matching to work as I would expect.
> >>
> >> [root@dev1 policy]# cat
> >> /etc/selinux/targeted/contexts/files/file_contexts | grep cinched
> >> /etc/cinched(/.*)?      system_u:object_r:ts_etc_t:s0
> >> /var/log/cinched(/.*)?  system_u:object_r:ts_log_t:s0
> >> /var/lib/cinched(/.*)?  system_u:object_r:ts_t:s0
> >> */usr/lib64/cinched(/.*)?        system_u:object_r:ts_lib_t:s0*
> >> /etc/bash_completion.d/cinched_bash_completions
> >> system_u:object_r:ts_etc_t:s0
> >> /var/log/cinched/audit(/.*)?    system_u:object_r:ts_audit_log_t:s0
> >> /usr/sbin/cinched       system_u:object_r:ts_exec_t:s0
> >>
> >> [root@dev1 policy]# matchpathcon /usr/lib64/cinched/
> >> */usr/lib64/cinched      system_u:object_r:lib_t:s0*
> >>
> >> [root@dev1 policy]# findcon
> >> /etc/selinux/targeted/contexts/files/file_contexts -p /usr/lib64/cinched
> >> /.*             system_u:object_r:default_t:s0
> >> /usr/.*         system_u:object_r:usr_t:s0
> >> */usr/lib64/cinched(/.*)?                system_u:object_r:ts_lib_t:s0*
> >>
> >>
> >> This is running on CentOS 7. I was assuming that since my rule has the
> >> longest stem, it would be applied.
> >>
> >> Any suggestions?
> >
> >
> > It would help to see the complete file_contexts file.
> > Do you have anything in file_contexts.local that could be overriding it?
>
> Also, it looks like file_context.subs_dist has the entry: '/usr/lib64
> /usr/lib' on CentOS 7. Perhaps Mark's file entries should instead be
> using /usr/lib/cinched?
>
> --Mike
>

[-- Attachment #2: Type: text/html, Size: 2864 bytes --]