Bug 801511

Summary:	restorecon doesn't change security context
Product:	[Fedora] Fedora	Reporter:	Sjoerd Mullender <sjoerd>
Component:	policycoreutils	Assignee:	Daniel Walsh <dwalsh>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	17	CC:	dwalsh, mgrepl
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-03-09 15:49:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Sjoerd Mullender 2012-03-08 17:38:46 UTC

Description of problem:
I'm trying to set the security context of a program to be shell_exec_t, but this fails.

Version-Release number of selected component (if applicable):
policycoreutils=2.1.10-26.fc17.x86_64

How reproducible:
100%

Steps to Reproduce:
1.create binary called /bin/esh
2./usr/sbin/semanage fcontext -a -t shell_exec_t /bin/esh
3./sbin/restorecon /bin/esh
  
Actual results:
ls -Z /bin/esh
-rwxr-xr-x. root root system_u:object_r:bin_t:s0 /bin/esh

Expected results:
ls -Z /bin/esh
-rwxr-xr-x. root root system_u:object_r:shell_exec_t:s0 /bin/esh


Additional info:
No errors are reported
semanage -o - shows as last line:
fcontext -a -f 'all files' -t shell_exec_t '/bin/esh'
All commands were of course run as root.

Comment 1 Daniel Walsh 2012-03-08 19:03:10 UTC

Try
/usr/sbin/semanage fcontext -a -t shell_exec_t /usr/bin/esh

Comment 2 Sjoerd Mullender 2012-03-08 20:44:12 UTC

This is weird.  I didn't expect this to help since the path that is specified is not the path of the binary, but it did help:

# ls -Z /bin/esh
-rwxr-xr-x. root root system_u:object_r:bin_t:s0 /bin/esh
# /usr/sbin/semanage fcontext -a -t shell_exec_t /usr/bin/esh
# /usr/sbin/semanage -o - | grep esh
fcontext -a -f 'all files' -t shell_exec_t '/bin/esh'
fcontext -a -f 'all files' -t shell_exec_t '/usr/bin/esh'
# /sbin/restorecon /bin/esh
# ls -Z /bin/esh
-rwxr-xr-x. root root system_u:object_r:shell_exec_t:s0 /bin/esh

Comment 3 Daniel Walsh 2012-03-09 15:09:41 UTC

/bin is a symbolic link to /usr/bin

Comment 4 Daniel Walsh 2012-03-09 15:10:16 UTC

But I take it esh should be labeled as a shell_exec_t?

Comment 5 Sjoerd Mullender 2012-03-09 15:14:41 UTC

(In reply to comment #3)
> /bin is a symbolic link to /usr/bin

That explains it!

(In reply to comment #4)
> But I take it esh should be labeled as a shell_exec_t?

Not by Fedora.  It's something of my own.

Comment 6 Daniel Walsh 2012-03-09 15:49:21 UTC

Well google actually says it exists as the "easy" shell.

http://linux.about.com/cs/linux101/g/esh.htm