On Fri, Jan 3, 2025 at 6:01 PM Sam Varshavchik via selinux <selinux@xxxxxxxxxxxxxxxxxxxxxxx> wrote:
Zdenek Pytela writes:
> Anyway, the long term solution is to change the entries to use /usr/bin.
So, right now:
1. A package installs stuff in /usr/sbin
2. It installs an selinux policy file referencing filenames in /usr/bin
Am I the only one who has …questions, here?
Firstly, there is an equivalency supporting the change:
f42# semanage fcontext -l | grep /usr/sbin.=
/usr/sbin = /usr/bin
f42# ls -Z /usr/sbin/sshd
system_u:object_r:sshd_exec_t:s0 /usr/sbin/sshd
f42# matchpathcon /usr/sbin/sshd
/usr/sbin/sshd system_u:object_r:sshd_exec_t:s0
Equivalency is a feature to substitute one path in the policy with another.
Secondly, there is a script to take care of all entries referring to /usr/sbin, e. g. from a local policy module. Feel free to file a bug report if an improvement is needed.
--
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
--
Zdenek Pytela
Security SELinux team
-- _______________________________________________ selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
