Bug 801511 - restorecon doesn't change security context
restorecon doesn't change security context
Product: Fedora
Classification: Fedora
Component: policycoreutils (Show other bugs)
x86_64 Linux
unspecified Severity unspecified
: ---
: ---
Assigned To: Daniel Walsh
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2012-03-08 12:38 EST by Sjoerd Mullender
Modified: 2012-03-09 10:49 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-03-09 10:49:32 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Sjoerd Mullender 2012-03-08 12:38:46 EST
Description of problem:
I'm trying to set the security context of a program to be shell_exec_t, but this fails.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.create binary called /bin/esh
2./usr/sbin/semanage fcontext -a -t shell_exec_t /bin/esh
3./sbin/restorecon /bin/esh
Actual results:
ls -Z /bin/esh
-rwxr-xr-x. root root system_u:object_r:bin_t:s0 /bin/esh

Expected results:
ls -Z /bin/esh
-rwxr-xr-x. root root system_u:object_r:shell_exec_t:s0 /bin/esh

Additional info:
No errors are reported
semanage -o - shows as last line:
fcontext -a -f 'all files' -t shell_exec_t '/bin/esh'
All commands were of course run as root.
Comment 1 Daniel Walsh 2012-03-08 14:03:10 EST
/usr/sbin/semanage fcontext -a -t shell_exec_t /usr/bin/esh
Comment 2 Sjoerd Mullender 2012-03-08 15:44:12 EST
This is weird.  I didn't expect this to help since the path that is specified is not the path of the binary, but it did help:

# ls -Z /bin/esh
-rwxr-xr-x. root root system_u:object_r:bin_t:s0 /bin/esh
# /usr/sbin/semanage fcontext -a -t shell_exec_t /usr/bin/esh
# /usr/sbin/semanage -o - | grep esh
fcontext -a -f 'all files' -t shell_exec_t '/bin/esh'
fcontext -a -f 'all files' -t shell_exec_t '/usr/bin/esh'
# /sbin/restorecon /bin/esh
# ls -Z /bin/esh
-rwxr-xr-x. root root system_u:object_r:shell_exec_t:s0 /bin/esh
Comment 3 Daniel Walsh 2012-03-09 10:09:41 EST
/bin is a symbolic link to /usr/bin
Comment 4 Daniel Walsh 2012-03-09 10:10:16 EST
But I take it esh should be labeled as a shell_exec_t?
Comment 5 Sjoerd Mullender 2012-03-09 10:14:41 EST
(In reply to comment #3)
> /bin is a symbolic link to /usr/bin

That explains it!

(In reply to comment #4)
> But I take it esh should be labeled as a shell_exec_t?

Not by Fedora.  It's something of my own.
Comment 6 Daniel Walsh 2012-03-09 10:49:21 EST
Well google actually says it exists as the "easy" shell.


Note You need to log in before you can comment on or make changes to this bug.