Re: Files created with the wrong context

On Thu, May 25, 2023 at 2:16 PM Dridi Boukelmoune <
[email protected]> wrote:

> Greetings,
>
> I have a custom policy that has a label for a directory and all its
> contents, except for one specific sub-directory that uses a more
> specific type. When a file is created in that sub-directory, it gets
> the general label instead of the specific one.
>
> It looks wrong, and at least restorecon seems to agree because it will
> happily relabel the offending file, meeting my expectations. I must be
> doing something wrong, probably missing something, but I have no idea
> what.
>
> Or could it be a bug? The kernel module could be evaluating rules in a
> different order, hence the discrepancy at file creation time. In my
> policy file contexts are sorted from least to most specific.
>
> Anyway, I can't share that, so I made a minimal reproducer:
>
>     https://github.com/dridi/selinux-lostlabel
>
> Any help appreciated, I tried really hard to understand what is going
> on, to no avail. The only similar search result was wrong labels in
> home directories showing up in several places but I couldn't find my
> nugget there.
>
> I initially sent an email and it's not showing up in the archive, so
> instead I subscribed to the list and started a new thread using the
> Hyperkitty interface. Apologies in advance if you receive it twice.
>
Hi,

Not sure if I understand properly, but I believe what you need is a file
transition, defined for the domain which is to create the directory with a
different type, otherwise inheritance applies. File context database is
only a static database for use by commands like restorecon or matchpathcon.

-- 

Zdenek Pytela
Security SELinux team

_______________________________________________
selinux mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue