Fedora Account System
Red Hat Associate
Red Hat Customer
OSTree adds several new toplevel symbolic links: First: /root -> /var/root At present the /root symlink is labeled admin_home_t, and I get: [ 12.169343] type=1400 audit(1391942787.266:54): avc: denied { read } for pid=276 comm="login" name="root" dev="vda3" ino=272480 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=lnk_file We could just label this as usr_t - it should basically be read-only to all domains except trusted ones, and everyone that matters already has { read }:lnk_file for usr_t. Likewise, the symlink *target* right now is var_t, and it should be admin_home_t. Same deal for: /home -> /var/home Another case here is the new special /sysroot I think this should get its own new type (sysroot_t ?) , and only privileged domains should be able to follow it.
Colin, could you try to add file equiv? # semanage fcontext -a -e /home /var/home # semanage fcontext -a -e /root /var/root # restorecon -R -v /var/home /var/root How does # ls -lZ / look on your test system? What is a structure of /sysroot?
(In reply to Miroslav Grepl from comment #1) > Colin, > could you try to add file equiv? > > # semanage fcontext -a -e /home /var/home > # semanage fcontext -a -e /root /var/root > # restorecon -R -v /var/home /var/root If you think it's too disruptive to have this in the default policy, I can definitely maintain my own. But I'd like to consider having this work out of the box with stock policy. > How does > > # ls -lZ / > > look on your test system? Right now: lrwxrwxrwx. root root system_u:object_r:bin_t:s0 bin -> usr/bin drwxr-xr-x. root root system_u:object_r:file_t:s0 boot drwxr-xr-x. root root system_u:object_r:device_t:s0 dev drwxr-xr-x. root root system_u:object_r:etc_t:s0 etc lrwxrwxrwx. root root system_u:object_r:home_root_t:s0 home -> var/home lrwxrwxrwx. root root system_u:object_r:lib_t:s0 lib -> usr/lib lrwxrwxrwx. root root system_u:object_r:lib_t:s0 lib64 -> usr/lib64 lrwxrwxrwx. root root system_u:object_r:default_t:s0 media -> run/media lrwxrwxrwx. root root system_u:object_r:default_t:s0 mnt -> var/mnt lrwxrwxrwx. root root system_u:object_r:usr_t:s0 opt -> var/opt lrwxrwxrwx. root root system_u:object_r:default_t:s0 ostree -> sysroot/ostree dr-xr-xr-x. root root system_u:object_r:proc_t:s0 proc lrwxrwxrwx. root root system_u:object_r:admin_home_t:s0 root -> var/roothome drwxr-xr-x. root root system_u:object_r:var_run_t:s0 run lrwxrwxrwx. root root system_u:object_r:bin_t:s0 sbin -> usr/sbin lrwxrwxrwx. root root system_u:object_r:var_t:s0 srv -> var/srv dr-xr-xr-x. root root system_u:object_r:sysfs_t:s0 sys drwxr-xr-x. root root system_u:object_r:file_t:s0 sysroot lrwxrwxrwx. root root system_u:object_r:tmp_t:s0 tmp -> sysroot/tmp drwxr-xr-x. root root system_u:object_r:usr_t:s0 usr drwxr-xr-x. root root system_u:object_r:var_t:s0 var > What is a structure of /sysroot? Remember with OSTree, we're booting directly into a chroot, physically located in /ostree/deploy/... /sysroot is just a bind mount to the real physical /. So we don't need to label anything underneath it.
Colin, I believe it should come with OSTree. I mean equiv definitions. Dan? Anyway we will need to add rules to allow read this top symlinks.
I have no problem putting these in the default.
Hopefully we won't see issues with local labels which won't be applied because of these equiv definitions.
What was the commit that was supposed to fix this? It *used* to work for me in rawhide, but has regressed I think. I think I need something like this: diff --git a/config/file_contexts.subs_dist b/config/file_contexts.subs_dist index d392dec..2403987 100644 --- a/config/file_contexts.subs_dist +++ b/config/file_contexts.subs_dist @@ -19,3 +19,7 @@ /usr/local/lib64 /usr/lib /usr/local/lib /usr/lib /var/run/lock /var/lock +# OSTree moves +/var/roothome /root +/var/srv /srv +/var/opt /opt
Oh I see... diff --git a/file_contexts.subs_dist b/file_contexts.subs_dist index 8292fe3..30de6cf 100644 --- a/file_contexts.subs_dist +++ b/file_contexts.subs_dist @@ -10,4 +10,4 @@ /etc/systemd/system /usr/lib/systemd/system /var/lib/xguest/home /home /var/home /home -/var/root /root +/var/roothome /root Now perhaps I should rename it, but it felt clearer if it was /var/roothome to me. /var/root seemed too generic.
Btw, rereading this bug I realized I gave you bad data. Sorry!
Ok, I added this change.