All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] policycoretuils: sestatus belongs to bin not sbin
@ 2021-02-13 20:43 bauen1
  2021-02-16 21:31 ` Nicolas Iooss
  0 siblings, 1 reply; 6+ messages in thread
From: bauen1 @ 2021-02-13 20:43 UTC (permalink / raw)
  To: selinux; +Cc: j2468h

It is quite useful even to non-privileged users and doesn't require any
privileges to work, except for maybe -v.

Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
---

 Only tested by running `make DESTDIR="$PWD" install` and checking that
 sestatus ends up at /usr/bin/sestatus

 policycoreutils/sestatus/Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/policycoreutils/sestatus/Makefile b/policycoreutils/sestatus/Makefile
index 8c4f45f8..ac113814 100644
--- a/policycoreutils/sestatus/Makefile
+++ b/policycoreutils/sestatus/Makefile
@@ -1,7 +1,7 @@
 # Installation directories.
 LINGUAS ?= ru
 PREFIX ?= /usr
-SBINDIR ?= $(PREFIX)/sbin
+BINDIR ?= $(PREFIX)/bin
 MANDIR = $(PREFIX)/share/man
 ETCDIR ?= /etc
 
@@ -16,8 +16,8 @@ sestatus: sestatus.o
 install: all
 	[ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
 	[ -d $(DESTDIR)$(MANDIR)/man5 ] || mkdir -p $(DESTDIR)$(MANDIR)/man5
-	-mkdir -p $(DESTDIR)$(SBINDIR)
-	install -m 755 sestatus $(DESTDIR)$(SBINDIR)
+	-mkdir -p $(DESTDIR)$(BINDIR)
+	install -m 755 sestatus $(DESTDIR)$(BINDIR)
 	install -m 644 sestatus.8 $(DESTDIR)$(MANDIR)/man8
 	install -m 644 sestatus.conf.5 $(DESTDIR)$(MANDIR)/man5
 	for lang in $(LINGUAS) ; do \
-- 
2.30.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH] policycoretuils: sestatus belongs to bin not sbin
  2021-02-13 20:43 [PATCH] policycoretuils: sestatus belongs to bin not sbin bauen1
@ 2021-02-16 21:31 ` Nicolas Iooss
  2021-02-17 16:29   ` bauen1
                     ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Nicolas Iooss @ 2021-02-16 21:31 UTC (permalink / raw)
  To: bauen1; +Cc: SElinux list

On Sat, Feb 13, 2021 at 9:44 PM bauen1 <j2468h@googlemail.com> wrote:
>
> It is quite useful even to non-privileged users and doesn't require any
> privileges to work, except for maybe -v.
>
> Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>

I agree with the reasoning, but changing the location of an existing
tool has the potential to break software which depends on the precise
location of sestatus (like
https://github.com/openstack/cookbook-openstack-dashboard/blob/86127240974041b456086b5fff6f8f525c9cf555/spec/spec_helper.rb#L82
and https://github.com/rapid7/metasploit-framework/blob/4a380771d3a18011af153e47e1d08a4a83feb452/lib/msf/core/post/linux/kernel.rb#L276
and https://github.com/RedHatInsights/insights-core/blob/6fd58aeab11232a62ea97ba576220abca808c660/insights/specs/default.py#L815
and ...).

On the other hand, if you have a clear use-case of non-privileged
users refusing to add /usr/sbin to their $PATH but willing to use
sestatus, and that supporting this use-case seems more important than
not breaking programs which rely on sestatus being in /usr/sbin, this
patch will be acceptable. Do you know of such a use-case?

(By the way, there is a misspelling in the patch subject: you wrote
"policycoretuils" instead of "policycoreutils")

Thanks,
Nicolas

> ---
>
>  Only tested by running `make DESTDIR="$PWD" install` and checking that
>  sestatus ends up at /usr/bin/sestatus
>
>  policycoreutils/sestatus/Makefile | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/policycoreutils/sestatus/Makefile b/policycoreutils/sestatus/Makefile
> index 8c4f45f8..ac113814 100644
> --- a/policycoreutils/sestatus/Makefile
> +++ b/policycoreutils/sestatus/Makefile
> @@ -1,7 +1,7 @@
>  # Installation directories.
>  LINGUAS ?= ru
>  PREFIX ?= /usr
> -SBINDIR ?= $(PREFIX)/sbin
> +BINDIR ?= $(PREFIX)/bin
>  MANDIR = $(PREFIX)/share/man
>  ETCDIR ?= /etc
>
> @@ -16,8 +16,8 @@ sestatus: sestatus.o
>  install: all
>         [ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
>         [ -d $(DESTDIR)$(MANDIR)/man5 ] || mkdir -p $(DESTDIR)$(MANDIR)/man5
> -       -mkdir -p $(DESTDIR)$(SBINDIR)
> -       install -m 755 sestatus $(DESTDIR)$(SBINDIR)
> +       -mkdir -p $(DESTDIR)$(BINDIR)
> +       install -m 755 sestatus $(DESTDIR)$(BINDIR)
>         install -m 644 sestatus.8 $(DESTDIR)$(MANDIR)/man8
>         install -m 644 sestatus.conf.5 $(DESTDIR)$(MANDIR)/man5
>         for lang in $(LINGUAS) ; do \
> --
> 2.30.0
>


^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] policycoretuils: sestatus belongs to bin not sbin
  2021-02-16 21:31 ` Nicolas Iooss
@ 2021-02-17 16:29   ` bauen1
  2021-02-17 16:32   ` Petr Lautrbach
  2021-02-18 18:33   ` [PATCH v2] policycoreutils: " bauen1
  2 siblings, 0 replies; 6+ messages in thread
From: bauen1 @ 2021-02-17 16:29 UTC (permalink / raw)
  To: Nicolas Iooss, bauen1; +Cc: SElinux list

On 2/16/21 10:31 PM, Nicolas Iooss wrote:
> On Sat, Feb 13, 2021 at 9:44 PM bauen1 <j2468h@googlemail.com> wrote:
>>
>> It is quite useful even to non-privileged users and doesn't require any
>> privileges to work, except for maybe -v.
>>
>> Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
> 
> I agree with the reasoning, but changing the location of an existing
> tool has the potential to break software which depends on the precise
> location of sestatus (like
> https://github.com/openstack/cookbook-openstack-dashboard/blob/86127240974041b456086b5fff6f8f525c9cf555/spec/spec_helper.rb#L82
> and https://github.com/rapid7/metasploit-framework/blob/4a380771d3a18011af153e47e1d08a4a83feb452/lib/msf/core/post/linux/kernel.rb#L276
> and https://github.com/RedHatInsights/insights-core/blob/6fd58aeab11232a62ea97ba576220abca808c660/insights/specs/default.py#L815
> and ...).

While I personally believe those shouldn't have been hard-coded in the first place, that is a good argument.
Would it be acceptable, if a symlink is added to /usr/sbin/sestatus to link to /usr/bin/sestatus (or the other way) ?

> On the other hand, if you have a clear use-case of non-privileged
> users refusing to add /usr/sbin to their $PATH but willing to use
> sestatus, and that supporting this use-case seems more important than
> not breaking programs which rely on sestatus being in /usr/sbin, this
> patch will be acceptable. Do you know of such a use-case?

My use case is logging in as my normal user account and checking if SELinux is properly working.
I'm not sure _why_ I should have to add sbin to $PATH to access a tool that works properly for non-privileged users, not that I couldn't do that.

IIRC I did once (~2 years ago) have /sbin, /usr/sbin in $PATH, but then I end up with a lot of tools in tab-complete that I can't actually use (properly) and I don't like that.

> (By the way, there is a misspelling in the patch subject: you wrote
> "policycoretuils" instead of "policycoreutils")

Thanks, I'll fix that if necessary.

-- 
bauen1
https://dn42.bauen1.xyz/

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] policycoretuils: sestatus belongs to bin not sbin
  2021-02-16 21:31 ` Nicolas Iooss
  2021-02-17 16:29   ` bauen1
@ 2021-02-17 16:32   ` Petr Lautrbach
  2021-02-18 18:33   ` [PATCH v2] policycoreutils: " bauen1
  2 siblings, 0 replies; 6+ messages in thread
From: Petr Lautrbach @ 2021-02-17 16:32 UTC (permalink / raw)
  To: SElinux list; +Cc: Nicolas Iooss, bauen1

Nicolas Iooss <nicolas.iooss@m4x.org> writes:

> On Sat, Feb 13, 2021 at 9:44 PM bauen1 <j2468h@googlemail.com> wrote:
>>
>> It is quite useful even to non-privileged users and doesn't require any
>> privileges to work, except for maybe -v.
>>
>> Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
>
> I agree with the reasoning, but changing the location of an existing
> tool has the potential to break software which depends on the precise
> location of sestatus (like
> https://github.com/openstack/cookbook-openstack-dashboard/blob/86127240974041b456086b5fff6f8f525c9cf555/spec/spec_helper.rb#L82
> and https://github.com/rapid7/metasploit-framework/blob/4a380771d3a18011af153e47e1d08a4a83feb452/lib/msf/core/post/linux/kernel.rb#L276
> and https://github.com/RedHatInsights/insights-core/blob/6fd58aeab11232a62ea97ba576220abca808c660/insights/specs/default.py#L815
> and ...).
>
> On the other hand, if you have a clear use-case of non-privileged
> users refusing to add /usr/sbin to their $PATH but willing to use
> sestatus, and that supporting this use-case seems more important than
> not breaking programs which rely on sestatus being in /usr/sbin, this
> patch will be acceptable. Do you know of such a use-case?
>
> (By the way, there is a misspelling in the patch subject: you wrote
> "policycoretuils" instead of "policycoreutils")
>

Could a symlink /usr/bin/sestatus -> ../sbin/sestatus solve this? 


> Thanks,
> Nicolas
>
>> ---
>>
>>  Only tested by running `make DESTDIR="$PWD" install` and checking that
>>  sestatus ends up at /usr/bin/sestatus
>>
>>  policycoreutils/sestatus/Makefile | 6 +++---
>>  1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/policycoreutils/sestatus/Makefile b/policycoreutils/sestatus/Makefile
>> index 8c4f45f8..ac113814 100644
>> --- a/policycoreutils/sestatus/Makefile
>> +++ b/policycoreutils/sestatus/Makefile
>> @@ -1,7 +1,7 @@
>>  # Installation directories.
>>  LINGUAS ?= ru
>>  PREFIX ?= /usr
>> -SBINDIR ?= $(PREFIX)/sbin
>> +BINDIR ?= $(PREFIX)/bin
>>  MANDIR = $(PREFIX)/share/man
>>  ETCDIR ?= /etc
>>
>> @@ -16,8 +16,8 @@ sestatus: sestatus.o
>>  install: all
>>         [ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
>>         [ -d $(DESTDIR)$(MANDIR)/man5 ] || mkdir -p $(DESTDIR)$(MANDIR)/man5
>> -       -mkdir -p $(DESTDIR)$(SBINDIR)
>> -       install -m 755 sestatus $(DESTDIR)$(SBINDIR)
>> +       -mkdir -p $(DESTDIR)$(BINDIR)
>> +       install -m 755 sestatus $(DESTDIR)$(BINDIR)
>>         install -m 644 sestatus.8 $(DESTDIR)$(MANDIR)/man8
>>         install -m 644 sestatus.conf.5 $(DESTDIR)$(MANDIR)/man5
>>         for lang in $(LINGUAS) ; do \
>> --
>> 2.30.0
>>


^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH v2] policycoreutils: sestatus belongs to bin not sbin
  2021-02-16 21:31 ` Nicolas Iooss
  2021-02-17 16:29   ` bauen1
  2021-02-17 16:32   ` Petr Lautrbach
@ 2021-02-18 18:33   ` bauen1
  2021-02-21 13:30     ` Nicolas Iooss
  2 siblings, 1 reply; 6+ messages in thread
From: bauen1 @ 2021-02-18 18:33 UTC (permalink / raw)
  To: selinux; +Cc: bauen1, Petr Lautrbach, Nicolas Iooss

It is quite useful even to non-privileged users and doesn't require any
privileges to work, except for maybe -v.

Some tools hard code the old path, so a compatibility symlink is also
created.

Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
---
 policycoreutils/sestatus/Makefile | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/policycoreutils/sestatus/Makefile b/policycoreutils/sestatus/Makefile
index 8c4f45f8..e108f96f 100644
--- a/policycoreutils/sestatus/Makefile
+++ b/policycoreutils/sestatus/Makefile
@@ -1,6 +1,7 @@
 # Installation directories.
 LINGUAS ?= ru
 PREFIX ?= /usr
+BINDIR ?= $(PREFIX)/bin
 SBINDIR ?= $(PREFIX)/sbin
 MANDIR = $(PREFIX)/share/man
 ETCDIR ?= /etc
@@ -16,8 +17,13 @@ sestatus: sestatus.o
 install: all
 	[ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
 	[ -d $(DESTDIR)$(MANDIR)/man5 ] || mkdir -p $(DESTDIR)$(MANDIR)/man5
+	-mkdir -p $(DESTDIR)$(BINDIR)
 	-mkdir -p $(DESTDIR)$(SBINDIR)
-	install -m 755 sestatus $(DESTDIR)$(SBINDIR)
+	# Some tools hardcode /usr/sbin/sestatus ; add a compatibility symlink
+	# install will overwrite a symlink, so create the symlink before calling
+	# install to allow distributions with BINDIR == SBINDIR
+	ln -s ../bin/sestatus $(DESTDIR)$(SBINDIR)
+	install -m 755 sestatus $(DESTDIR)$(BINDIR)
 	install -m 644 sestatus.8 $(DESTDIR)$(MANDIR)/man8
 	install -m 644 sestatus.conf.5 $(DESTDIR)$(MANDIR)/man5
 	for lang in $(LINGUAS) ; do \
-- 
2.30.1


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH v2] policycoreutils: sestatus belongs to bin not sbin
  2021-02-18 18:33   ` [PATCH v2] policycoreutils: " bauen1
@ 2021-02-21 13:30     ` Nicolas Iooss
  0 siblings, 0 replies; 6+ messages in thread
From: Nicolas Iooss @ 2021-02-21 13:30 UTC (permalink / raw)
  To: bauen1; +Cc: SElinux list, Petr Lautrbach

On Thu, Feb 18, 2021 at 7:33 PM bauen1 <j2468h@googlemail.com> wrote:
>
> It is quite useful even to non-privileged users and doesn't require any
> privileges to work, except for maybe -v.
>
> Some tools hard code the old path, so a compatibility symlink is also
> created.
>
> Signed-off-by: Jonathan Hettwer <j2468h@gmail.com>
> ---
>  policycoreutils/sestatus/Makefile | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/policycoreutils/sestatus/Makefile b/policycoreutils/sestatus/Makefile
> index 8c4f45f8..e108f96f 100644
> --- a/policycoreutils/sestatus/Makefile
> +++ b/policycoreutils/sestatus/Makefile
> @@ -1,6 +1,7 @@
>  # Installation directories.
>  LINGUAS ?= ru
>  PREFIX ?= /usr
> +BINDIR ?= $(PREFIX)/bin
>  SBINDIR ?= $(PREFIX)/sbin
>  MANDIR = $(PREFIX)/share/man
>  ETCDIR ?= /etc
> @@ -16,8 +17,13 @@ sestatus: sestatus.o
>  install: all
>         [ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
>         [ -d $(DESTDIR)$(MANDIR)/man5 ] || mkdir -p $(DESTDIR)$(MANDIR)/man5
> +       -mkdir -p $(DESTDIR)$(BINDIR)
>         -mkdir -p $(DESTDIR)$(SBINDIR)
> -       install -m 755 sestatus $(DESTDIR)$(SBINDIR)
> +       # Some tools hardcode /usr/sbin/sestatus ; add a compatibility symlink
> +       # install will overwrite a symlink, so create the symlink before calling
> +       # install to allow distributions with BINDIR == SBINDIR
> +       ln -s ../bin/sestatus $(DESTDIR)$(SBINDIR)

This assumes that $(BINDIR) == $(SBINDIR)/../bin, which is likely to
be true but which would break if not. Moreover, not using "-f" breaks
running "make install" twice:

ln -s ../bin/sestatus /my-DESTDIR/usr/sbin
ln: failed to create symbolic link '/my-DESTDIR/usr/sbin/sestatus': File exists

To fix both these issues, you can add --relative and -f like other
Makefiles in the project:

ln -sf --relative $(DESTDIR)$(BINDIR)/sestatus $(DESTDIR)$(SBINDIR)

Doing this seems to work fine on my test system. Could you please send
a v3 with this?

By the way I confirm that this v2 addresses the previous comments I
made on the first version of this patch, thanks!
Nicolas


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-02-21 13:31 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-13 20:43 [PATCH] policycoretuils: sestatus belongs to bin not sbin bauen1
2021-02-16 21:31 ` Nicolas Iooss
2021-02-17 16:29   ` bauen1
2021-02-17 16:32   ` Petr Lautrbach
2021-02-18 18:33   ` [PATCH v2] policycoreutils: " bauen1
2021-02-21 13:30     ` Nicolas Iooss

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.