Bug 145359 - inconsistent chcon failure: can't apply partial context to unlabeled file
inconsistent chcon failure: can't apply partial context to unlabeled file
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: coreutils (Show other bugs)
3
All Linux
medium Severity medium
: ---
: ---
Assigned To: Tim Waugh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-01-17 14:04 EST by Tom Lane
Modified: 2013-07-02 23:03 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-01-18 06:34:44 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Tom Lane 2005-01-17 14:04:49 EST
Description of problem:
I'm currently testing a new init script for postgresql that does
this to create a log file that's not known to selinux-policy-targeted:

PGLOG=/var/lib/pgsql/pgstartup.log
touch "$PGLOG" || exit 1
chown postgres:postgres "$PGLOG"
chmod go-rwx "$PGLOG"
[ -x /usr/bin/chcon ] && /usr/bin/chcon -t postgresql_log_t "$PGLOG"

This works fine for me, but I have a report that someone else running
the same coreutils release gets

/usr/bin/chcon: can't apply partial context to unlabeled file
/var/lib/pgsql/pgstartup.log

Any idea why it fails for him, and what I can do about it?


Version-Release number of selected component (if applicable):
coreutils-5.2.1-31

How reproducible:
100% for him, 0% for me

Steps to Reproduce:
1.  See above, or install postgresql-8.0.0rc5-0.3 from fc4-scratch
2.
3.
  
Actual results:


Expected results:


Additional info:
See thread beginning at
http://lists.pgfoundry.org/pipermail/pgsqlrpms-hackers/2005-January/000076.html
Comment 1 Tim Waugh 2005-01-18 06:34:44 EST
Well, like the error says, you can't have a partial label.  Your
/var/lib/pgsql/pgstartup.log file is already labelled and so it makes sense to
change part of the label.  Their file has no pre-existing label, and so what
you're trying to do doesn't make sense.

(Dan, is that right?)
Comment 2 Tom Lane 2005-01-18 08:31:27 EST
Hm ... so how do I find out what label is on a file?  I've looked through the man pages for the selinux 
commands I know about, and found nothing :-(
Comment 3 Tim Waugh 2005-01-18 08:37:01 EST
ls -Z
Comment 4 Daniel Walsh 2005-01-18 17:42:06 EST
This says the file has no label to start, so you can specify just a partial
context.  So I believe the user is running on a unlabeled system.
IE 

ls -Z shows no label.

so chcon -t XYZ fails because there is no User or Role section.

Note You need to log in before you can comment on or make changes to this bug.