Thanks guys, I forgot to check the _dist file, switching to /usr/lib did the trick.
Cheers,
Mark
On Tue, Feb 2, 2016 at 1:31 PM, Mike Palmiotto <mike.palmiotto@xxxxxxxxxxxxxxx> wrote:
Also, it looks like file_context.subs_dist has the entry: '/usr/lib64On Tue, Feb 2, 2016 at 1:15 PM, Stephen Smalley <sds@xxxxxxxxxxxxx> wrote:
> On 02/02/2016 12:48 PM, Mark Steele wrote:
>>
>> Hi list,
>>
>> I've got some file contexts setup for an application, and can't get the
>> file context matching to work as I would expect.
>>
>> [root@dev1 policy]# cat
>> /etc/selinux/targeted/contexts/files/file_contexts | grep cinched
>> /etc/cinched(/.*)? system_u:object_r:ts_etc_t:s0
>> /var/log/cinched(/.*)? system_u:object_r:ts_log_t:s0
>> /var/lib/cinched(/.*)? system_u:object_r:ts_t:s0
>> */usr/lib64/cinched(/.*)? system_u:object_r:ts_lib_t:s0*
>> /etc/bash_completion.d/cinched_bash_completions
>> system_u:object_r:ts_etc_t:s0
>> /var/log/cinched/audit(/.*)? system_u:object_r:ts_audit_log_t:s0
>> /usr/sbin/cinched system_u:object_r:ts_exec_t:s0
>>
>> [root@dev1 policy]# matchpathcon /usr/lib64/cinched/
>> */usr/lib64/cinched system_u:object_r:lib_t:s0*
>>
>> [root@dev1 policy]# findcon
>> /etc/selinux/targeted/contexts/files/file_contexts -p /usr/lib64/cinched
>> /.* system_u:object_r:default_t:s0
>> /usr/.* system_u:object_r:usr_t:s0
>> */usr/lib64/cinched(/.*)? system_u:object_r:ts_lib_t:s0*
>>
>>
>> This is running on CentOS 7. I was assuming that since my rule has the
>> longest stem, it would be applied.
>>
>> Any suggestions?
>
>
> It would help to see the complete file_contexts file.
> Do you have anything in file_contexts.local that could be overriding it?
/usr/lib' on CentOS 7. Perhaps Mark's file entries should instead be
using /usr/lib/cinched?
--Mike
_______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
