Bug 1260238
Summary: | RFE: restorecon should say in verbose mode when it doesn't change a context due to customizable_type | |||
---|---|---|---|---|
Product: | Red Hat Enterprise Linux 7 | Reporter: | M. Scherer <mscherer> | |
Component: | policycoreutils | Assignee: | Petr Lautrbach <plautrba> | |
Status: | CLOSED ERRATA | QA Contact: | Dalibor Pospíšil <dapospis> | |
Severity: | unspecified | Docs Contact: | ||
Priority: | unspecified | |||
Version: | 7.3 | CC: | dwalsh, lvrabec, mgrepl, mmalik, mthacker, plautrba, pvrabec, ssekidde, vmojzis | |
Target Milestone: | rc | Keywords: | Documentation, FutureFeature, Reopened | |
Target Release: | --- | |||
Hardware: | All | |||
OS: | Linux | |||
Whiteboard: | ||||
Fixed In Version: | Doc Type: | Enhancement | ||
Doc Text: | Story Points: | --- | ||
Clone Of: | ||||
: | 1513098 (view as bug list) | Environment: | ||
Last Closed: | 2018-04-10 16:36:29 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: |
Description
M. Scherer
2015-09-04 21:48:20 UTC
If that matter, /tmp is not a tmpfs. I did some tweak and it seems to be really just sandbox_file_t : ~ $ sudo chcon system_u:object_r:sandbox_file_t:s0 /tmp ~ $ sudo restorecon -v /tmp ~ $ sudo chcon system_u:object_r:etc_t:s0 /tmp/ ~ $ sudo restorecon -v /tmp restorecon reset /tmp context system_u:object_r:etc_t:s0->system_u:object_r:tmp_t:s0 I did test with other directories, and /root, /etc exhibit the same behavior. I also did test with others contexts, and so far, it work fine, except with sandbox_file_t. So digging into the issue, that's because sandbox_file_t is listed in customizable_type. I am not sure on what would be a right fix, but I would expect at minima that restorecon -v tell me that it doesn't restore on purpose the context. But I agree that's a tricky problem to decide what is the right behavior :/ # ls -dZ /tmp/ drwxrwxrwt. root root system_u:object_r:tmp_t:s0 /tmp/ # chcon -t sandbox_file_t /tmp # ls -dZ /tmp/ drwxrwxrwt. root root system_u:object_r:sandbox_file_t:s0 /tmp/ # restorecon -RvF /tmp/ restorecon reset /tmp context system_u:object_r:sandbox_file_t:s0->system_u:object_r:tmp_t:s0 # restorecon -F forces relabel, Ignores customizable types. But I would not advise this since things like containers, svirt, openshift, sandboxes all rely on this alternate label. Well, that's because it is not advisable to use -F by default that I changed the title of this bug to be a RFE for "say something when something was not changed despites user expectation". I do not see how and why the fact that svirt openshift and others use that as a reason to not give more information to users, therefor, I reopen the RFE. Ok, I can see this. Although it will potentially noisy on a full restore. You can use restorecon -vv if you need more verbose output: # restorecon -vv /etc/machine-id restorecon: /etc/machine-id not reset customized by admin to system_u:object_r:svirt_sandbox_file_t:s0 I didn't knew there was 2 different level of verbosity, likely because that's neither in the man page, nor the --help output. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:0913 |