[PATCH] policycoreutils/scripts/fixfiles: drop /tmp cleanup
Stephen Smalley <[email protected]>
| Newsgroups | org.kernel.vger.selinux |
|---|---|
| Message-ID | <[email protected]> |
The /tmp/{gconfd-*,pulse-*,orbit-*} directories are no longer
created/used by those daemons so we can drop the old commands removing
them.
The find commands used to find unlabeled files under /tmp and other
directories and then invoke chcon on their pathnames will re-lookup
the full path each time and is therefore subject to TOCTOU issues.
Since some of these directories are tmpfs on modern Linux systems,
they can't have any lingering unlabeled files anyway from a prior
SELinux-disabled boot and we can't restorecon at least some of these
directories because they have <<none>> in file_contexts. Just drop
this /tmp cleanup altogether - it is unsafe and shouldn't be needed
anymore.
Signed-off-by: Stephen Smalley <[email protected]>
---
policycoreutils/scripts/fixfiles | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index b7cd765c..b5f193e1 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -288,16 +288,6 @@ case "$RESTORE_MODE" in
if [ ${OPTION} != "Relabel" ]; then
return
fi
- echo "Cleaning up labels on /tmp"
- rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
-
- UNDEFINED=`get_undefined_type` || exit $?
- UNLABELED=`get_unlabeled_type` || exit $?
- find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) \( -type s -o -type p \) -delete
- find /tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /tmp {} \;
- find /var/tmp \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/tmp {} \;
- find /var/run \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /var/run {} \;
- [ ! -e /var/lib/debug ] || find /var/lib/debug \( -context "*:${UNLABELED}*" -o -context "*:${UNDEFINED}*" \) -exec chcon --no-dereference --reference /lib {} \;
;;
esac
}
--
2.55.0