On Thu, 2012-02-09 at 07:59 -0500, Edward Ned Harvey wrote:
If there is a directory in your system, and you want all new files created in that directory to inherit the context type of the parent folder, is there a way to do that? Something like the selinux equivalent of the setgid bit?
Yes, This is the default behaviour:
[dominick@x220 ~]$ id -Z unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [dominick@x220 ~]$ mkdir test [dominick@x220 ~]$ ls -dZ test drwxrwxr-x. dominick dominick unconfined_u:object_r:user_home_t:s0 test [dominick@x220 ~]$ touch test/test [dominick@x220 ~]$ ls -alZ test drwxrwxr-x. dominick dominick unconfined_u:object_r:user_home_t:s0 . drwx------. dominick dominick unconfined_u:object_r:user_home_dir_t:s0 .. -rw-rw-r--. dominick dominick unconfined_u:object_r:user_home_t:s0 test [dominick@x220 ~]$
Note that when a process with type unconfined_t creates a file (test) in a directory with type user_home_t, that this file inherits the type of the parent directory (user_home_t)
or...
If you are going to do something a moment from now which will create some files, and you want them to be created with a specific context type, is there a way to do that? Something like the selinux equivalent of umask?
Yes, It is called a "type_transition". This behavior needs to be specified and it depends on the process type creating the object, the type of the directory where this object is created in.
Examples:
default behavior:
allow a process with type myprocess1_t to create a file in a directory with type user_home_t:
# Add a directory entry to directories with type user_home_t allow process1_t user_home_t:dir { getattr search open lock ioctl write add_name };
# Create a file with type user_home_t allow process1_t user_home_t:file { getattr create open };
allow a process with type myprocess2_t to create a file in a directory with type myfile_t in a directory with type user_home_t using a type transition.
# Add a directory entry to directories with type user_home_t. allow process2_t user_home_t:dir { getattr search open lock ioctl write add_name };
# When a process with type process2_t creates a file in a directory with type user_home_t, then create that file with type myfile_t using a type transition. type_transition process2_t user_home_t:file myfile_t;
# Create a file with type myfile_t. allow process2_t myfile_t:file { getattr create open };
The situation is this: I'm supporting a web hosting company who uses drupal, and they're constantly adding & removing plugins via drush. Since this is a non-OS-specific application, it doesn't know anything about how it should set the context on files it creates. Fortunately, (!) my client has been hacked before, so they're extremely cautious when it comes to ignoring selinux practices. They are manually changing the context of all these files, which is tedious. But at least they're doing it.
So these rules depend on they type of the source (the process creating the file) and the type of the directory where the target object is created in.
If you have a single process type that needs to be able to create both files with a type that is inherited from its parent and files with a private tyoe using a type transition in a single directory then there is a conflict in older SELinux configurations.
A possible solution for this is to create a separate directory with a separate type for content that needs to be created with a type transition. Although if you are able to do that then you may not need a type transition rule anymore.
In recent SELinux configurations this is not needed because it supports a thing called "named file transitions". This is the same as type transitions except that it also takes a name of the object to be created.
This allows you to specify for example that:
1. if a process with type myprocess1_t creates a file with name "file1" in a directory with user_home_t, then create the file with type myfile_t using a type transition.
2. if a process with type myprocess1_t creates a file with name "file2" in a directory with user_home_t, then create the file with type yourfile_t using a type transition.
Would look something like this:
# Add a directory entry to directories with type user_home_t. allow process1_t user_home_t:dir { getattr search open lock ioctl write add_name };
# When a process with type process1_t creates a file with name "file1" in a directory with type user_home_t, then create that file with type myfile_t using a type transition. type_transition process1_t user_home_t:file myfile_t "file1";
# Create a file with type myfile_t. allow process1_t myfile_t:file { getattr create open };
# When a process with type process1_t creates a file with name "file2" in a directory with type user_home_t, then create that file with type yourfile_t using a type transition. type_transition process1_t user_home_t:file yourfile_t "file2";
# Create a file with type yourfile_t. allow process1_t yourfile_t:file { getattr create open };
I'm hoping for a better way, and since my knowledge is pretty much limited to the light saber book, I don't recall any mention of anything like this.
Thanks for any suggestions...
Your options depend on the properties of your environment.
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux