On 02/26/2010 12:56 PM, Stephen Smalley wrote:
Problems with the new fixfiles logic even with kernels>= 2.6.30:
- Bind mounts are not excluded (and note that they aren't marked with
bind as an option in /proc/mounts - only in /etc/mtab aka mount output):
# mkdir /foo
# mount -o bind /etc /foo
# grep /foo /proc/mounts
/dev/root /foo ext4 rw,seclabel,relatime,barrier=1,data=ordered 0 0
# grep /foo /etc/mtab
/etc /foo none rw,bind 0 0
- You are assuming fixed option ordering and that no other options can
appear between "rw" and "seclabel" in your grep pattern for
FILESYSTEMSRW. As a trivial counterexample, if the user mounts with a
rootcontext= option (override the root directory context, but allow
setting of individual file contexts), it won't match. If we can assume
that seclabel always follows rw, then you can use grep
'rw,.*seclabel' /proc/self/mounts. If they used a regular context=
mount option, then seclabel won't be displayed so that will get
excluded.
- The definition for FILESYSTEMSRO appears to be wrong. I think
possibly you want grep 'ro,.*seclabel' there (i.e. filesystems mounted
read-only that support labeling). Simple test case:
# mount -o remount,ro /boot
# grep 'ro,.*seclabel' /proc/mounts
/dev/sda1 /boot ext3
ro,seclabel,relatime,errors=continue,user_xattr,acl,data=ordered 0 0
I think we just want to remove this and go with the
restorecon -R /
With the ro fix, I just sent.
The problem with this is if you have a seclabel file system mounted on a
non seclabel file system, it will not get labeled. But trying to figure
out whether a file system is seclabel or not along with figuring out
bind mounts is not going to be easy. The way we have it now I think
will cause multiple passes.
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
