On 17 Jan 2002, Justin Smith wrote:

> When trying to label files with the setfiles utilities, the process
> crashes when they encounter the .journal files. These are user-visible,
> but are not regular files (they are immutable in the sense that even
> root cannot change them in any way). The setfiles utilities issue a
> warning that they cannot write to .journal and quit.
>
> Any ideas?
>
> Perhaps there should be some way of exempting the .journal files from
> the labelling process. It is unfortunate that they are visible to users
> (since users cannot actually use them for anything).

First, the journals aren't visible to users on my RH7.2 systems running the SELinux kernel, so I'm not sure why they are visible on your system.

Second, setfiles should not need to write to .journal. However, it does need to be able to set the label of .journal. If you are running setfiles on a non-SELinux kernel, setfiles directly updates the persistent label mapping files in /...security. If you are running setfiles on a SELinux kernel, setfiles uses the lchsid system call to set the label for each file. At present, lchsid fails on immutable files, just like chmod and chown. However, there isn't any strong reason to prevent relabeling of immutable files, so we could remove this restriction from the [l|f|]chsid calls in the SELinux module.

Third, you can exempt files from the labeling process by using the <<none>> specification in the file_contexts configuration. So, to exempt .journal files from being relabeled by setfiles, you might add the following to the end of file_contexts:

.*/\.journal <<none>>

Of course, this is a questionable choice. We should probably define a type for the journal files so that they can be rigorously protected by the SELinux nondiscretionary access controls.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.