Yuichi Nakamura wrote: >We found that in FedoraCore3 fixfiles.cron is removed after yum update. >It seems that there is no fixfiles.cron in the latest policycoreutils. >Why is it removed? > >I think fixfiles.cron is necessary to maintain security. > >--- >Yuichi Nakamura >Japan SELinux Users Group(JSELUG) > http://www.selinux.gr.jp/ > >-- >fedora-selinux-list mailing list >fedora-selinux-list@xxxxxxxxxx >http://www.redhat.com/mailman/listinfo/fedora-selinux-list > > fixfiles.cron causes more problems than it solves. It made little sense in targeted policy. It also informed users of problems when there were none and it some cases would open up security holes. Consider if a user wants to make a copy of his gpg keys, he makes a copy maintaining the security context, next time fixfiles.cron runs it will tell the administrator that he has mislabeled files and he might blindly relabel them, removing the save security context. The other example was if users are labeling directories to be run by apache using the full power of httpd_TYPE_script_rw_t and others, the fixfiles will report these as errors. So until someone comes up with a better way to handle these situations I thought it better to not install it any longer. Dan
