[PATCH] policycoreutils/scripts/fixfiles: drop /tmp cleanup

Stephen Smalley <[email protected]>
Newsgroups org.kernel.vger.selinux
Message-ID <[email protected]>
The /tmp/{gconfd-*,pulse-*,orbit-*} directories are no longer
created/used by those daemons so we can drop the old commands removing
them.

The find commands used to find unlabeled files under /tmp and other
directories and then invoke chcon on their pathnames will re-lookup
the full path each time and is therefore subject to TOCTOU issues.
Since some of these directories are tmpfs on modern Linux systems,
they can't have any lingering unlabeled files anyway from a prior
SELinux-disabled boot and we can't restorecon at least some of these
directories because they have <<none>> in file_contexts. Just drop
this /tmp cleanup altogether - it is unsafe and shouldn't be needed
anymore.

Signed-off-by: Stephen Smalley <[email protected]>
---
 policycoreutils/scripts/fixfiles | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index b7cd765c..b5f193e1 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -288,16 +288,6 @@ case "$RESTORE_MODE" in
 	if [ ${OPTION} != "Relabel" ]; then
 	    return
 	fi
-	echo "Cleaning up labels on /tmp"
-	rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
-
-	UNDEFINED=`get_undefined_type` || exit $?
-	UNLABELED=`get_unlabeled_type` || exit $?
-	find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) \( -type s -o -type p \) -delete
-	find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /tmp {} \;
-	find /var/tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/tmp {} \;
-	find /var/run \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/run {} \;
-	[ ! -e /var/lib/debug ] || find /var/lib/debug \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /lib {} \;
     ;;
 esac
 }
-- 
2.55.0
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.