Addition of selinux users causes "Multiple same specifications" warnings during startup

[Radha Venkatesh (radvenka)]

I have created SeLinux users using "semanage user" and tied the SeLinux
users to Linux users using "semanage login". I find that on startup,
there are several warnings thrown for "Multiple same specifications".
Below is an example
 
/etc/selinux/strict/contexts/files/file_contexts: Multiple same
specifications for /dev/null/\.screenrc
 
I then checked and found that file_contexts has
 
file_contexts.homedirs:/dev/null/\.screenrc     --
ccmusergrp_u:object_r:user_screen_ro_home_t:s0
file_contexts.homedirs:/dev/null/\.screenrc     --
ccmusergrp_u:object_r:user_screen_ro_home_t:s0
file_contexts.homedirs:/dev/null/\.screenrc     --
specialuser_u:object_r:user_screen_ro_home_t:s0
file_contexts.homedirs:/dev/null/\.screenrc     --
ccmusergrp_u:object_r:user_screen_ro_home_t:s0
file_contexts.homedirs:/dev/null/\.screenrc     --
ccmusergrp_u:object_r:user_screen_ro_home_t:s0
file_contexts.homedirs:/dev/null/\.screenrc     --
specialuser_u:object_r:user_screen_ro_home_t:s0

Looks like there is an entry for every Linux user I tied to the SeLinux
user.
 
I am using

libselinux-1.33.4-5.5.el5
libsemanage-1.9.1-4.4.el5
policycoreutils-1.33.12-14.8.el5
libsepol-1.15.2-3.el5
 
and do not have an option to move to later releases.
 
Is there a way for me to get rid of these warnings or suppress them,
without changing the source code provided by RedHat?
 
Thanks,
Radha.

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
>  I have created SeLinux users using "semanage user" and tied
> the SeLinux
>  users to Linux users using "semanage login". I find that on startup,
>  there are several warnings thrown for "Multiple same specifications".
>  Below is an example
>   
>  /etc/selinux/strict/contexts/files/file_contexts: Multiple same
>  specifications for /dev/null/\.screenrc
>   
>  I then checked and found that file_contexts has
>   
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  ccmusergrp_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  ccmusergrp_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  specialuser_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  ccmusergrp_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  ccmusergrp_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  specialuser_u:object_r:user_screen_ro_home_t:s0
>  
>  Looks like there is an entry for every Linux user I tied to the SeLinux
>  user.
>   
>  I am using
>  
>  libselinux-1.33.4-5.5.el5
>  libsemanage-1.9.1-4.4.el5
>  policycoreutils-1.33.12-14.8.el5
>  libsepol-1.15.2-3.el5
>   
>  and do not have an option to move to later releases.
>   
>  Is there a way for me to get rid of these warnings or suppress them,
>  without changing the source code provided by RedHat?
>   
>  Thanks,
>  Radha.
>   
>  
>   
>  
>  
>  
>  
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
This looks like /dev/null
is defined as a homedir?
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky4pQ8ACgkQrlYvE4MpobNAaQCgj1YodMZ/YN6yd8Kk8Ff5rc/T
> WPEAoOZLk3LQS47HQLtyEeQ/mXsli6v1
> =Yr37
> -----END PGP SIGNATURE-----

[Radha Venkatesh (radvenka)]

Yes, for security reasons, /dev/null is being used as the homedir for
users in our product.

Thanks,
Radha. 

-----Original Message-----
From: Daniel J Walsh [mailto:[e-mail]] 
Sent: Friday, October 15, 2010 12:02 PM
To: Radha Venkatesh (radvenka)
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: Addition of selinux users causes "Multiple same
specifications" warnings during startup

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
>  I have created SeLinux users using "semanage user" and tied
> the 
>  SeLinux users to Linux users using "semanage login". I find that on 
>  startup, there are several warnings thrown for "Multiple same
specifications".
>  Below is an example
>   
>  /etc/selinux/strict/contexts/files/file_contexts: Multiple same 
>  specifications for /dev/null/\.screenrc
>   
>  I then checked and found that file_contexts has
>   
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  ccmusergrp_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  ccmusergrp_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  specialuser_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  ccmusergrp_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  ccmusergrp_u:object_r:user_screen_ro_home_t:s0
>  file_contexts.homedirs:/dev/null/\.screenrc     --
>  specialuser_u:object_r:user_screen_ro_home_t:s0
>  
>  Looks like there is an entry for every Linux user I tied to the 
>  SeLinux user.
>   
>  I am using
>  
>  libselinux-1.33.4-5.5.el5
>  libsemanage-1.9.1-4.4.el5
>  policycoreutils-1.33.12-14.8.el5
>  libsepol-1.15.2-3.el5
>   
>  and do not have an option to move to later releases.
>   
>  Is there a way for me to get rid of these warnings or suppress them, 
>  without changing the source code provided by RedHat?
>   
>  Thanks,
>  Radha.
>   
>  
>   
>  
>  
>  
>  
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
This looks like /dev/null
is defined as a homedir?
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky4pQ8ACgkQrlYvE4MpobNAaQCgj1YodMZ/YN6yd8Kk8Ff5rc/T
> WPEAoOZLk3LQS47HQLtyEeQ/mXsli6v1
> =Yr37
> -----END PGP SIGNATURE-----

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/15/2010 03:11 PM, Radha Venkatesh (radvenka) wrote:
>  
>  Yes, for security reasons, /dev/null is being used as the homedir for
>  users in our product.
>  
>  Thanks,
>  Radha. 
>  
>  -----Original Message-----
>  From: Daniel J Walsh [mailto:[e-mail]] 
>  Sent: Friday, October 15, 2010 12:02 PM
>  To: Radha Venkatesh (radvenka)
>  Cc: fedora-selinux-list(a)redhat.com
>  Subject: Re: Addition of selinux users causes "Multiple same
>  specifications" warnings during startup
>  
>  On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
> > I have created SeLinux users using "semanage user" and tied the 
> > SeLinux users to Linux users using "semanage login". I find that on 
> > startup, there are several warnings thrown for "Multiple same
>  specifications".
> > Below is an example
>  
> > /etc/selinux/strict/contexts/files/file_contexts: Multiple same 
> > specifications for /dev/null/\.screenrc
>  
> > I then checked and found that file_contexts has
>  
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > specialuser_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > specialuser_u:object_r:user_screen_ro_home_t:s0
>  
> > Looks like there is an entry for every Linux user I tied to the 
> > SeLinux user.
>  
> > I am using
>  
> > libselinux-1.33.4-5.5.el5
> > libsemanage-1.9.1-4.4.el5
> > policycoreutils-1.33.12-14.8.el5
> > libsepol-1.15.2-3.el5
>  
> > and do not have an option to move to later releases.
>  
> > Is there a way for me to get rid of these warnings or suppress them, 
> > without changing the source code provided by RedHat?
>  
> > Thanks,
> > Radha.
>  
>  
>  
>  
>  
>  
>  
> > --
> > selinux mailing list
> > selinux(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
>  This looks like /dev/null is defined as a homedir? 
- --
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinu
x

genhomedircon is looking at homedirs of what it considers real users.
and generating file context based on this.  This is going to cause a
problem if all the users have the same homedir /dev/null.  Which is what
you are seeing.  I don't think in RHEL5 there is a way to stop
genhomedircon from being run.

usepasswd=FALSE

in /etc/selinux/semanage.conf does this in RHEL6.

Do these users actually login to the the system, if not changing their
shell to /bin/false or /sbin/nologin will stop genhomedircon from adding
homedir entries.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky4qOYACgkQrlYvE4MpobMqeACfT2890mL67gVhJeZD8ArKtmxM
> JIIAn0V1AXIu3FrA8zmjKsU6hk3sqbzZ
> =vk/i
> -----END PGP SIGNATURE-----

[Radha Venkatesh (radvenka)]

Dan,

These users do not login to the system and their shells are already set
to /sbin/nologin. 

Thanks,
Radha.

-----Original Message-----
From: Daniel J Walsh [mailto:[e-mail]] 
Sent: Friday, October 15, 2010 12:18 PM
To: Radha Venkatesh (radvenka)
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: Addition of selinux users causes "Multiple same
specifications" warnings during startup

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/15/2010 03:11 PM, Radha Venkatesh (radvenka) wrote:
>  
>  Yes, for security reasons, /dev/null is being used as the homedir for 
>  users in our product.
>  
>  Thanks,
>  Radha. 
>  
>  -----Original Message-----
>  From: Daniel J Walsh [mailto:[e-mail]]
>  Sent: Friday, October 15, 2010 12:02 PM
>  To: Radha Venkatesh (radvenka)
>  Cc: fedora-selinux-list(a)redhat.com
>  Subject: Re: Addition of selinux users causes "Multiple same 
>  specifications" warnings during startup
>  
>  On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
> > I have created SeLinux users using "semanage user" and tied the 
> > SeLinux users to Linux users using "semanage login". I find that on 
> > startup, there are several warnings thrown for "Multiple same
>  specifications".
> > Below is an example
>  
> > /etc/selinux/strict/contexts/files/file_contexts: Multiple same 
> > specifications for /dev/null/\.screenrc
>  
> > I then checked and found that file_contexts has
>  
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > specialuser_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> > file_contexts.homedirs:/dev/null/\.screenrc     --
> > specialuser_u:object_r:user_screen_ro_home_t:s0
>  
> > Looks like there is an entry for every Linux user I tied to the 
> > SeLinux user.
>  
> > I am using
>  
> > libselinux-1.33.4-5.5.el5
> > libsemanage-1.9.1-4.4.el5
> > policycoreutils-1.33.12-14.8.el5
> > libsepol-1.15.2-3.el5
>  
> > and do not have an option to move to later releases.
>  
> > Is there a way for me to get rid of these warnings or suppress them, 
> > without changing the source code provided by RedHat?
>  
> > Thanks,
> > Radha.
>  
>  
>  
>  
>  
>  
>  
> > --
> > selinux mailing list
> > selinux(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
>  This looks like /dev/null is defined as a homedir? 
- --
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinu
x

genhomedircon is looking at homedirs of what it considers real users.
and generating file context based on this.  This is going to cause a
problem if all the users have the same homedir /dev/null.  Which is what
you are seeing.  I don't think in RHEL5 there is a way to stop
genhomedircon from being run.

usepasswd=FALSE

in /etc/selinux/semanage.conf does this in RHEL6.

Do these users actually login to the the system, if not changing their
shell to /bin/false or /sbin/nologin will stop genhomedircon from adding
homedir entries.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky4qOYACgkQrlYvE4MpobMqeACfT2890mL67gVhJeZD8ArKtmxM
> JIIAn0V1AXIu3FrA8zmjKsU6hk3sqbzZ
> =vk/i
> -----END PGP SIGNATURE-----

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/15/2010 03:27 PM, Radha Venkatesh (radvenka) wrote:
>  
>  Dan,
>  
>  These users do not login to the system and their shells are already set
>  to /sbin/nologin. 
>  
>  Thanks,
>  Radha. 
Then why are you assigning user context to the accounts.  genhomedircon
must have a bug in that it is ignoring the shell if the user has an
assigned seusers label.
>  
>  -----Original Message-----
>  From: Daniel J Walsh [mailto:[e-mail]] 
>  Sent: Friday, October 15, 2010 12:18 PM
>  To: Radha Venkatesh (radvenka)
>  Cc: fedora-selinux-list(a)redhat.com
>  Subject: Re: Addition of selinux users causes "Multiple same
>  specifications" warnings during startup
>  
>  On 10/15/2010 03:11 PM, Radha Venkatesh (radvenka) wrote:
>  
> > Yes, for security reasons, /dev/null is being used as the homedir for 
> > users in our product.
>  
> > Thanks,
> > Radha. 
>  
> > -----Original Message-----
> > From: Daniel J Walsh [mailto:[e-mail]]
> > Sent: Friday, October 15, 2010 12:02 PM
> > To: Radha Venkatesh (radvenka)
> > Cc: fedora-selinux-list(a)redhat.com
> > Subject: Re: Addition of selinux users causes "Multiple same 
> > specifications" warnings during startup
>  
> > On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
> >> I have created SeLinux users using "semanage user" and tied the 
> >> SeLinux users to Linux users using "semanage login". I find that on 
> >> startup, there are several warnings thrown for "Multiple same
> > specifications".
> >> Below is an example
>  
> >> /etc/selinux/strict/contexts/files/file_contexts: Multiple same 
> >> specifications for /dev/null/\.screenrc
>  
> >> I then checked and found that file_contexts has
>  
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> specialuser_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> specialuser_u:object_r:user_screen_ro_home_t:s0
>  
> >> Looks like there is an entry for every Linux user I tied to the 
> >> SeLinux user.
>  
> >> I am using
>  
> >> libselinux-1.33.4-5.5.el5
> >> libsemanage-1.9.1-4.4.el5
> >> policycoreutils-1.33.12-14.8.el5
> >> libsepol-1.15.2-3.el5
>  
> >> and do not have an option to move to later releases.
>  
> >> Is there a way for me to get rid of these warnings or suppress them, 
> >> without changing the source code provided by RedHat?
>  
> >> Thanks,
> >> Radha.
>  
>  
>  
>  
>  
>  
>  
> >> --
> >> selinux mailing list
> >> selinux(a)lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/selinux
> > > This looks like /dev/null is defined as a homedir?
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky4sQ0ACgkQrlYvE4MpobOCIQCfT9wyJVOqwLL7Qpia8WEIuK+Y
> Lc8AoJcAuBqaxzM0ENUhB9a6nlGHEpUf
> =oFYy
> -----END PGP SIGNATURE-----

[Radha Venkatesh (radvenka)]

Dan,

I have created SeLinux users which can take on roles of system_r and
sysadm_r and tied them the Linux users created (though they are
nologin). This is needed so that these linux users can execute
applications in our product taking on system_r or sysadm_r roles.

Thanks,
Radha.

-----Original Message-----
From: Daniel J Walsh [mailto:[e-mail]] 
Sent: Friday, October 15, 2010 12:53 PM
To: Radha Venkatesh (radvenka)
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: Addition of selinux users causes "Multiple same
specifications" warnings during startup

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/15/2010 03:27 PM, Radha Venkatesh (radvenka) wrote:
>  
>  Dan,
>  
>  These users do not login to the system and their shells are already 
>  set to /sbin/nologin.
>  
>  Thanks,
>  Radha. 
Then why are you assigning user context to the accounts.  genhomedircon
must have a bug in that it is ignoring the shell if the user has an
assigned seusers label.
>  
>  -----Original Message-----
>  From: Daniel J Walsh [mailto:[e-mail]]
>  Sent: Friday, October 15, 2010 12:18 PM
>  To: Radha Venkatesh (radvenka)
>  Cc: fedora-selinux-list(a)redhat.com
>  Subject: Re: Addition of selinux users causes "Multiple same 
>  specifications" warnings during startup
>  
>  On 10/15/2010 03:11 PM, Radha Venkatesh (radvenka) wrote:
>  
> > Yes, for security reasons, /dev/null is being used as the homedir for 
> > users in our product.
>  
> > Thanks,
> > Radha. 
>  
> > -----Original Message-----
> > From: Daniel J Walsh [mailto:[e-mail]]
> > Sent: Friday, October 15, 2010 12:02 PM
> > To: Radha Venkatesh (radvenka)
> > Cc: fedora-selinux-list(a)redhat.com
> > Subject: Re: Addition of selinux users causes "Multiple same 
> > specifications" warnings during startup
>  
> > On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
> >> I have created SeLinux users using "semanage user" and tied the 
> >> SeLinux users to Linux users using "semanage login". I find that on 
> >> startup, there are several warnings thrown for "Multiple same
> > specifications".
> >> Below is an example
>  
> >> /etc/selinux/strict/contexts/files/file_contexts: Multiple same 
> >> specifications for /dev/null/\.screenrc
>  
> >> I then checked and found that file_contexts has
>  
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> specialuser_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >> file_contexts.homedirs:/dev/null/\.screenrc     --
> >> specialuser_u:object_r:user_screen_ro_home_t:s0
>  
> >> Looks like there is an entry for every Linux user I tied to the 
> >> SeLinux user.
>  
> >> I am using
>  
> >> libselinux-1.33.4-5.5.el5
> >> libsemanage-1.9.1-4.4.el5
> >> policycoreutils-1.33.12-14.8.el5
> >> libsepol-1.15.2-3.el5
>  
> >> and do not have an option to move to later releases.
>  
> >> Is there a way for me to get rid of these warnings or suppress them, 
> >> without changing the source code provided by RedHat?
>  
> >> Thanks,
> >> Radha.
>  
>  
>  
>  
>  
>  
>  
> >> --
> >> selinux mailing list
> >> selinux(a)lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/selinux
> > > This looks like /dev/null is defined as a homedir?
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky4sQ0ACgkQrlYvE4MpobOCIQCfT9wyJVOqwLL7Qpia8WEIuK+Y
> Lc8AoJcAuBqaxzM0ENUhB9a6nlGHEpUf
> =oFYy
> -----END PGP SIGNATURE-----

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/15/2010 04:58 PM, Radha Venkatesh (radvenka) wrote:
>  
>  Dan,
>  
>  I have created SeLinux users which can take on roles of system_r and
>  sysadm_r and tied them the Linux users created (though they are
>  nologin). This is needed so that these linux users can execute
>  applications in our product taking on system_r or sysadm_r roles.
>  
>  Thanks,
>  Radha. 
Right but how do they get logged on to the machine?
>  
>  -----Original Message-----
>  From: Daniel J Walsh [mailto:[e-mail]] 
>  Sent: Friday, October 15, 2010 12:53 PM
>  To: Radha Venkatesh (radvenka)
>  Cc: fedora-selinux-list(a)redhat.com
>  Subject: Re: Addition of selinux users causes "Multiple same
>  specifications" warnings during startup
>  
>  On 10/15/2010 03:27 PM, Radha Venkatesh (radvenka) wrote:
>  
> > Dan,
>  
> > These users do not login to the system and their shells are already 
> > set to /sbin/nologin.
>  
> > Thanks,
> > Radha.
>  
>  Then why are you assigning user context to the accounts.  genhomedircon
>  must have a bug in that it is ignoring the shell if the user has an
>  assigned seusers label.
>  
> > -----Original Message-----
> > From: Daniel J Walsh [mailto:[e-mail]]
> > Sent: Friday, October 15, 2010 12:18 PM
> > To: Radha Venkatesh (radvenka)
> > Cc: fedora-selinux-list(a)redhat.com
> > Subject: Re: Addition of selinux users causes "Multiple same 
> > specifications" warnings during startup
>  
> > On 10/15/2010 03:11 PM, Radha Venkatesh (radvenka) wrote:
>  
> >> Yes, for security reasons, /dev/null is being used as the homedir for
>  
> >> users in our product.
>  
> >> Thanks,
> >> Radha. 
>  
> >> -----Original Message-----
> >> From: Daniel J Walsh [mailto:[e-mail]]
> >> Sent: Friday, October 15, 2010 12:02 PM
> >> To: Radha Venkatesh (radvenka)
> >> Cc: fedora-selinux-list(a)redhat.com
> >> Subject: Re: Addition of selinux users causes "Multiple same 
> >> specifications" warnings during startup
>  
> >> On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
> >>> I have created SeLinux users using "semanage user" and tied the 
> >>> SeLinux users to Linux users using "semanage login". I find that on
>
> >>> startup, there are several warnings thrown for "Multiple same
> >> specifications".
> >>> Below is an example
>  
> >>> /etc/selinux/strict/contexts/files/file_contexts: Multiple same 
> >>> specifications for /dev/null/\.screenrc
>  
> >>> I then checked and found that file_contexts has
>  
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> specialuser_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> specialuser_u:object_r:user_screen_ro_home_t:s0
>  
> >>> Looks like there is an entry for every Linux user I tied to the 
> >>> SeLinux user.
>  
> >>> I am using
>  
> >>> libselinux-1.33.4-5.5.el5
> >>> libsemanage-1.9.1-4.4.el5
> >>> policycoreutils-1.33.12-14.8.el5
> >>> libsepol-1.15.2-3.el5
>  
> >>> and do not have an option to move to later releases.
>  
> >>> Is there a way for me to get rid of these warnings or suppress them,
>  
> >>> without changing the source code provided by RedHat?
>  
> >>> Thanks,
> >>> Radha.
>  
>  
>  
>  
>  
>  
>  
> >>> --
> >>> selinux mailing list
> >>> selinux(a)lists.fedoraproject.org
> >>> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >> This looks like /dev/null is defined as a homedir? 
- --
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky4w9AACgkQrlYvE4MpobMupQCdFmM4qMTbQ0mUyVdJ164KO7H7
> Uw4AoJsRbeMfRbJsBsNd1Ab0Qny7Jc7B
> =yB73
> -----END PGP SIGNATURE-----

[Radha Venkatesh (radvenka)]

These users do not log onto the machine. They just execute these
applications (su / sudo)

Thanks,
Radha. 

-----Original Message-----
From: Daniel J Walsh [mailto:[e-mail]] 
Sent: Friday, October 15, 2010 2:13 PM
To: Radha Venkatesh (radvenka)
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: Addition of selinux users causes "Multiple same
specifications" warnings during startup

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/15/2010 04:58 PM, Radha Venkatesh (radvenka) wrote:
>  
>  Dan,
>  
>  I have created SeLinux users which can take on roles of system_r and 
>  sysadm_r and tied them the Linux users created (though they are 
>  nologin). This is needed so that these linux users can execute 
>  applications in our product taking on system_r or sysadm_r roles.
>  
>  Thanks,
>  Radha. 
Right but how do they get logged on to the machine?
>  
>  -----Original Message-----
>  From: Daniel J Walsh [mailto:[e-mail]]
>  Sent: Friday, October 15, 2010 12:53 PM
>  To: Radha Venkatesh (radvenka)
>  Cc: fedora-selinux-list(a)redhat.com
>  Subject: Re: Addition of selinux users causes "Multiple same 
>  specifications" warnings during startup
>  
>  On 10/15/2010 03:27 PM, Radha Venkatesh (radvenka) wrote:
>  
> > Dan,
>  
> > These users do not login to the system and their shells are already 
> > set to /sbin/nologin.
>  
> > Thanks,
> > Radha.
>  
>  Then why are you assigning user context to the accounts.  
>  genhomedircon must have a bug in that it is ignoring the shell if the 
>  user has an assigned seusers label.
>  
> > -----Original Message-----
> > From: Daniel J Walsh [mailto:[e-mail]]
> > Sent: Friday, October 15, 2010 12:18 PM
> > To: Radha Venkatesh (radvenka)
> > Cc: fedora-selinux-list(a)redhat.com
> > Subject: Re: Addition of selinux users causes "Multiple same 
> > specifications" warnings during startup
>  
> > On 10/15/2010 03:11 PM, Radha Venkatesh (radvenka) wrote:
>  
> >> Yes, for security reasons, /dev/null is being used as the homedir 
> >> for
>  
> >> users in our product.
>  
> >> Thanks,
> >> Radha. 
>  
> >> -----Original Message-----
> >> From: Daniel J Walsh [mailto:[e-mail]]
> >> Sent: Friday, October 15, 2010 12:02 PM
> >> To: Radha Venkatesh (radvenka)
> >> Cc: fedora-selinux-list(a)redhat.com
> >> Subject: Re: Addition of selinux users causes "Multiple same 
> >> specifications" warnings during startup
>  
> >> On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
> >>> I have created SeLinux users using "semanage user" and tied the 
> >>> SeLinux users to Linux users using "semanage login". I find that on
> >>> startup, there are several warnings thrown for
> "Multiple same
> >> specifications".
> >>> Below is an example
>  
> >>> /etc/selinux/strict/contexts/files/file_contexts: Multiple same 
> >>> specifications for /dev/null/\.screenrc
>  
> >>> I then checked and found that file_contexts has
>  
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> specialuser_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> specialuser_u:object_r:user_screen_ro_home_t:s0
>  
> >>> Looks like there is an entry for every Linux user I tied to the 
> >>> SeLinux user.
>  
> >>> I am using
>  
> >>> libselinux-1.33.4-5.5.el5
> >>> libsemanage-1.9.1-4.4.el5
> >>> policycoreutils-1.33.12-14.8.el5
> >>> libsepol-1.15.2-3.el5
>  
> >>> and do not have an option to move to later releases.
>  
> >>> Is there a way for me to get rid of these warnings or suppress 
> >>> them,
>  
> >>> without changing the source code provided by RedHat?
>  
> >>> Thanks,
> >>> Radha.
>  
>  
>  
>  
>  
>  
>  
> >>> --
> >>> selinux mailing list
> >>> selinux(a)lists.fedoraproject.org
> >>> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >> This looks like /dev/null is defined as a homedir? 
- --
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky4w9AACgkQrlYvE4MpobMupQCdFmM4qMTbQ0mUyVdJ164KO7H7
> Uw4AoJsRbeMfRbJsBsNd1Ab0Qny7Jc7B
> =yB73
> -----END PGP SIGNATURE-----

[Radha Venkatesh (radvenka)]

Dan,

Clarifying my email / question further - The login is as an admin user,
and su / sudo is done to execute the applications as these users
mentioned below (nologin users). What action can I take to prevent the
warnings for multiple specifications? 

Thanks,
Radha.

-----Original Message-----
From: Daniel J Walsh [mailto:[e-mail]]
Sent: Friday, October 15, 2010 2:13 PM
To: Radha Venkatesh (radvenka)
Cc: fedora-selinux-list(a)redhat.com
Subject: Re: Addition of selinux users causes "Multiple same
specifications" warnings during startup

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/15/2010 04:58 PM, Radha Venkatesh (radvenka) wrote:
>  
>  Dan,
>  
>  I have created SeLinux users which can take on roles of system_r and 
>  sysadm_r and tied them the Linux users created (though they are 
>  nologin). This is needed so that these linux users can execute 
>  applications in our product taking on system_r or sysadm_r roles.
>  
>  Thanks,
>  Radha. 
Right but how do they get logged on to the machine?
>  
>  -----Original Message-----
>  From: Daniel J Walsh [mailto:[e-mail]]
>  Sent: Friday, October 15, 2010 12:53 PM
>  To: Radha Venkatesh (radvenka)
>  Cc: fedora-selinux-list(a)redhat.com
>  Subject: Re: Addition of selinux users causes "Multiple same 
>  specifications" warnings during startup
>  
>  On 10/15/2010 03:27 PM, Radha Venkatesh (radvenka) wrote:
>  
> > Dan,
>  
> > These users do not login to the system and their shells are already 
> > set to /sbin/nologin.
>  
> > Thanks,
> > Radha.
>  
>  Then why are you assigning user context to the accounts.  
>  genhomedircon must have a bug in that it is ignoring the shell if the 
>  user has an assigned seusers label.
>  
> > -----Original Message-----
> > From: Daniel J Walsh [mailto:[e-mail]]
> > Sent: Friday, October 15, 2010 12:18 PM
> > To: Radha Venkatesh (radvenka)
> > Cc: fedora-selinux-list(a)redhat.com
> > Subject: Re: Addition of selinux users causes "Multiple same 
> > specifications" warnings during startup
>  
> > On 10/15/2010 03:11 PM, Radha Venkatesh (radvenka) wrote:
>  
> >> Yes, for security reasons, /dev/null is being used as the homedir 
> >> for
>  
> >> users in our product.
>  
> >> Thanks,
> >> Radha. 
>  
> >> -----Original Message-----
> >> From: Daniel J Walsh [mailto:[e-mail]]
> >> Sent: Friday, October 15, 2010 12:02 PM
> >> To: Radha Venkatesh (radvenka)
> >> Cc: fedora-selinux-list(a)redhat.com
> >> Subject: Re: Addition of selinux users causes "Multiple same 
> >> specifications" warnings during startup
>  
> >> On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
> >>> I have created SeLinux users using "semanage user" and tied the 
> >>> SeLinux users to Linux users using "semanage login". I find that on
> >>> startup, there are several warnings thrown for
> "Multiple same
> >> specifications".
> >>> Below is an example
>  
> >>> /etc/selinux/strict/contexts/files/file_contexts: Multiple same 
> >>> specifications for /dev/null/\.screenrc
>  
> >>> I then checked and found that file_contexts has
>  
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> specialuser_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>> specialuser_u:object_r:user_screen_ro_home_t:s0
>  
> >>> Looks like there is an entry for every Linux user I tied to the 
> >>> SeLinux user.
>  
> >>> I am using
>  
> >>> libselinux-1.33.4-5.5.el5
> >>> libsemanage-1.9.1-4.4.el5
> >>> policycoreutils-1.33.12-14.8.el5
> >>> libsepol-1.15.2-3.el5
>  
> >>> and do not have an option to move to later releases.
>  
> >>> Is there a way for me to get rid of these warnings or suppress 
> >>> them,
>  
> >>> without changing the source code provided by RedHat?
>  
> >>> Thanks,
> >>> Radha.
>  
>  
>  
>  
>  
>  
>  
> >>> --
> >>> selinux mailing list
> >>> selinux(a)lists.fedoraproject.org
> >>> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >> This looks like /dev/null is defined as a homedir? 
- --
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky4w9AACgkQrlYvE4MpobMupQCdFmM4qMTbQ0mUyVdJ164KO7H7
> Uw4AoJsRbeMfRbJsBsNd1Ab0Qny7Jc7B
> =yB73
> -----END PGP SIGNATURE-----

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/18/2010 12:38 PM, Radha Venkatesh (radvenka) wrote:
>   
>  Dan,
>  
>  Clarifying my email / question further - The login is as an admin user,
>  and su / sudo is done to execute the applications as these users
>  mentioned below (nologin users). What action can I take to prevent the
>  warnings for multiple specifications? 
>  
>  Thanks,
>  Radha.
>  
>  -----Original Message-----
>  From: Daniel J Walsh [mailto:[e-mail]]
>  Sent: Friday, October 15, 2010 2:13 PM
>  To: Radha Venkatesh (radvenka)
>  Cc: fedora-selinux-list(a)redhat.com
>  Subject: Re: Addition of selinux users causes "Multiple same
>  specifications" warnings during startup
>  
>  On 10/15/2010 04:58 PM, Radha Venkatesh (radvenka) wrote:
>  
> > Dan,
>  
> > I have created SeLinux users which can take on roles of system_r and 
> > sysadm_r and tied them the Linux users created (though they are 
> > nologin). This is needed so that these linux users can execute 
> > applications in our product taking on system_r or sysadm_r roles.
>  
> > Thanks,
> > Radha.
>  
>  Right but how do they get logged on to the machine?
>  
> > -----Original Message-----
> > From: Daniel J Walsh [mailto:[e-mail]]
> > Sent: Friday, October 15, 2010 12:53 PM
> > To: Radha Venkatesh (radvenka)
> > Cc: fedora-selinux-list(a)redhat.com
> > Subject: Re: Addition of selinux users causes "Multiple same 
> > specifications" warnings during startup
>  
> > On 10/15/2010 03:27 PM, Radha Venkatesh (radvenka) wrote:
>  
> >> Dan,
>  
> >> These users do not login to the system and their shells are already 
> >> set to /sbin/nologin.
>  
> >> Thanks,
> >> Radha.
>  
> > Then why are you assigning user context to the accounts.  
> > genhomedircon must have a bug in that it is ignoring the shell if the 
> > user has an assigned seusers label.
>  
> >> -----Original Message-----
> >> From: Daniel J Walsh [mailto:[e-mail]]
> >> Sent: Friday, October 15, 2010 12:18 PM
> >> To: Radha Venkatesh (radvenka)
> >> Cc: fedora-selinux-list(a)redhat.com
> >> Subject: Re: Addition of selinux users causes "Multiple same 
> >> specifications" warnings during startup
>  
> >> On 10/15/2010 03:11 PM, Radha Venkatesh (radvenka) wrote:
>  
> >>> Yes, for security reasons, /dev/null is being used as the homedir 
> >>> for
>  
> >>> users in our product.
>  
> >>> Thanks,
> >>> Radha. 
>  
> >>> -----Original Message-----
> >>> From: Daniel J Walsh [mailto:[e-mail]]
> >>> Sent: Friday, October 15, 2010 12:02 PM
> >>> To: Radha Venkatesh (radvenka)
> >>> Cc: fedora-selinux-list(a)redhat.com
> >>> Subject: Re: Addition of selinux users causes "Multiple same 
> >>> specifications" warnings during startup
>  
> >>> On 10/15/2010 02:33 PM, Radha Venkatesh (radvenka) wrote:
> >>>> I have created SeLinux users using "semanage user" and tied the
>
> >>>> SeLinux users to Linux users using "semanage login". I find
> that on
>  
> >>>> startup, there are several warnings thrown for "Multiple same
> >>> specifications".
> >>>> Below is an example
>  
> >>>> /etc/selinux/strict/contexts/files/file_contexts: Multiple same 
> >>>> specifications for /dev/null/\.screenrc
>  
> >>>> I then checked and found that file_contexts has
>  
> >>>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>>> specialuser_u:object_r:user_screen_ro_home_t:s0
> >>>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>>> ccmusergrp_u:object_r:user_screen_ro_home_t:s0
> >>>> file_contexts.homedirs:/dev/null/\.screenrc     --
> >>>> specialuser_u:object_r:user_screen_ro_home_t:s0
>  
> >>>> Looks like there is an entry for every Linux user I tied to the 
> >>>> SeLinux user.
>  
> >>>> I am using
>  
> >>>> libselinux-1.33.4-5.5.el5
> >>>> libsemanage-1.9.1-4.4.el5
> >>>> policycoreutils-1.33.12-14.8.el5
> >>>> libsepol-1.15.2-3.el5
>  
> >>>> and do not have an option to move to later releases.
>  
> >>>> Is there a way for me to get rid of these warnings or suppress 
> >>>> them,
>  
> >>>> without changing the source code provided by RedHat?
>  
> >>>> Thanks,
> >>>> Radha.
>  
>  
>  
>  
>  
>  
>  
> >>>> --
> >>>> selinux mailing list
> >>>> selinux(a)lists.fedoraproject.org
> >>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
> >>> This looks like /dev/null is defined as a homedir? 
- --
selinux mailing list
selinux(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux

Yes if a user never logs into a system there is no reason to associate a
login record to that account.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky8flMACgkQrlYvE4MpobNSLgCgggWlqEu6gnreogFt6NoO6mTd
> L3AAn2x8EmkOUhP1TlbH75I86QxHMvux
> =jJ+z
> -----END PGP SIGNATURE-----

Seek for help

[su heng]

Hi,

I have two problem want to fix.

Firstly,

[root@localhost tmp]# mkdir test
[root@localhost tmp]# ls -dZ test
drwxr-xr-x. root root unconfined_u:object_r:user_tmp_t:s0 test
[root@localhost tmp]# semanage fcontext -a -t samba_share_t
"/tmp/test(/.*)?"
[root@localhost tmp]# restorecon -R -v /tmp/test/
restorecon reset /tmp/test context
unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:samba_share_t:s0
[root@localhost tmp]# ls -dZ test
drwxr-xr-x. root root system_u:object_r:samba_share_t:s0 test
------------------------------------------------------------------
When I tried to delete the type, an error happened. 
[root@localhost tmp]# semanage fcontext -d /tmp/test/
Can't create lock file '/var/cache/abrt/pyhook-1287493825-3446.lock':
Permission denied
Traceback (most recent call last):
  File "/usr/sbin/semanage", line 501, in <module>
    process_args(sys.argv[1:])
  File "/usr/sbin/semanage", line 437, in process_args
    OBJECT.delete(target, ftype)
  File "/usr/lib/python2.6/site-packages/seobject.py", line 1623, in
delete
    self.__delete( target, ftype)
  File "/usr/lib/python2.6/site-packages/seobject.py", line 1594, in
__delete
    if target in self.equiv.keys():
AttributeError: fcontextRecords instance has no attribute 'equiv'


And I have searched from Google, there is a bug has been reported. So I
update it to the latest selinux-policy. The error still. How should I
do?

Secondly,
   I have read the document which resided on fedora site. I have a
question. 
We can change the type or the domain of a file or process which can let
us pass through the check of se-linux. 
And we also can write a policy file to pass through se-linux.

   These two methods are the same destination? If so, which one is
better when we try to use and why? 
If not, Please give me some suggestion about the difference and when we
should to use for them?
   

Thanks & Best Regards,
Su Heng

Seek for help

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/19/2010 09:33 AM, su heng wrote:
>  Hi,
>  
>  I have two problem want to fix.
>  
>  Firstly,
>  
>  [root@localhost tmp]# mkdir test
>  [root@localhost tmp]# ls -dZ test
>  drwxr-xr-x. root root unconfined_u:object_r:user_tmp_t:s0 test
>  [root@localhost tmp]# semanage fcontext -a -t samba_share_t
>  "/tmp/test(/.*)?"
>  [root@localhost tmp]# restorecon -R -v /tmp/test/
>  restorecon reset /tmp/test context
>  unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:samba_share_t:s0
>  [root@localhost tmp]# ls -dZ test
>  drwxr-xr-x. root root system_u:object_r:samba_share_t:s0 test
>  ------------------------------------------------------------------
>  When I tried to delete the type, an error happened. 
>  [root@localhost tmp]# semanage fcontext -d /tmp/test/
>  Can't create lock file '/var/cache/abrt/pyhook-1287493825-3446.lock':
>  Permission denied
>  Traceback (most recent call last):
>    File "/usr/sbin/semanage", line 501, in <module>
>      process_args(sys.argv[1:])
>    File "/usr/sbin/semanage", line 437, in process_args
>      OBJECT.delete(target, ftype)
>    File "/usr/lib/python2.6/site-packages/seobject.py", line 1623, in
>  delete
>      self.__delete( target, ftype)
>    File "/usr/lib/python2.6/site-packages/seobject.py", line 1594, in
>  __delete
>      if target in self.equiv.keys():
>  AttributeError: fcontextRecords instance has no attribute 'equiv'
>  
>   
This looks like a bug in semanage

rpm -q policycoreutils

This line
# semanage fcontext -d /tmp/test/

should be
# semanage fcontext -d "/tmp/test(/.*)?"

But it looks like you will still have the bug.

>  And I have searched from Google, there is a bug has been reported. So
> I
>  update it to the latest selinux-policy. The error still. How should I
>  do?
>  
>  Secondly,
>     I have read the document which resided on fedora site. I have a
>  question. 
>  We can change the type or the domain of a file or process which can let
>  us pass through the check of se-linux. 
>  And we also can write a policy file to pass through se-linux.
>  
>     These two methods are the same destination? If so, which one is
>  better when we try to use and why? 
>  If not, Please give me some suggestion about the difference and when we
>  should to use for them?
>      
Not sure I understand the question.  I would say you want to change the
domain of the process or the context of the file to match the truth.
For example, if you have a file that needs to be shared by samba then it
is usually better to change the label to samba_share_t rather then run
the samba process as an unconfined process.

But it is best for you to describe the exact problem that you are having
with SELinux
>  
>  Thanks & Best Regards,
>  Su Heng
>  
>  
>  
>  
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky8XhQACgkQrlYvE4MpobNZnACg2t5t/FhYW/Uu0qj2nSaabi2t
> p+4Ani7GbglSmdwsdBvwz2hrGVMRvrGW
> =25Nd
> -----END PGP SIGNATURE-----

Seek for help

[su heng]

Hi Daniel,

	Thanks for your reply. Please see my remarks,Thanks.

On Mon, 2010-10-18 at 10:47 -0400, Daniel J Walsh wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 10/19/2010 09:33 AM, su heng wrote:
>  > Hi,
>  > 
>  > I have two problem want to fix.
>  > 
>  > Firstly,
>  > 
>  > [root@localhost tmp]# mkdir test
>  > [root@localhost tmp]# ls -dZ test
>  > drwxr-xr-x. root root unconfined_u:object_r:user_tmp_t:s0 test
>  > [root@localhost tmp]# semanage fcontext -a -t samba_share_t
>  > "/tmp/test(/.*)?"
>  > [root@localhost tmp]# restorecon -R -v /tmp/test/
>  > restorecon reset /tmp/test context
>  > unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:samba_share_t:s0
>  > [root@localhost tmp]# ls -dZ test
>  > drwxr-xr-x. root root system_u:object_r:samba_share_t:s0 test
>  > ------------------------------------------------------------------
>  > When I tried to delete the type, an error happened. 
>  > [root@localhost tmp]# semanage fcontext -d /tmp/test/
>  > Can't create lock file '/var/cache/abrt/pyhook-1287493825-3446.lock':
>  > Permission denied
>  > Traceback (most recent call last):
>  >   File "/usr/sbin/semanage", line 501, in <module>
>  >     process_args(sys.argv[1:])
>  >   File "/usr/sbin/semanage", line 437, in process_args
>  >     OBJECT.delete(target, ftype)
>  >   File "/usr/lib/python2.6/site-packages/seobject.py", line 1623, in
>  > delete
>  >     self.__delete( target, ftype)
>  >   File "/usr/lib/python2.6/site-packages/seobject.py", line 1594, in
>  > __delete
>  >     if target in self.equiv.keys():
>  > AttributeError: fcontextRecords instance has no attribute 'equiv'
>  > 
>  > 
>  This looks like a bug in semanage 
[Su Heng:] Which bug describe it and could u give
me a URL as a
reference?
>  
>  rpm -q policycoreutils 
[Su Heng:] What is this line used for? I get a result under
my shell:
[root@localhost suheng]# rpm -q policycoreutils
policycoreutils-2.0.74-4.fc12.i686

>  
>  This line
>  # semanage fcontext -d /tmp/test/
>  
>  should be
>  # semanage fcontext -d "/tmp/test(/.*)?" 
[Su Heng:] Yes, thanks, the same
error still.
And I want know the solution for this issue. Could u give me some more
details to fix it?
>  
>  But it looks like you will still have the bug.
>  
>  > And I have searched from Google, there is a bug has been reported. So I
>  > update it to the latest selinux-policy. The error still. How should I
>  > do?
>  > 
>  > Secondly,
>  >    I have read the document which resided on fedora site. I have a
>  > question. 
>  > We can change the type or the domain of a file or process which can let
>  > us pass through the check of se-linux. 
>  > And we also can write a policy file to pass through se-linux.
>  > 
>  >    These two methods are the same destination? If so, which one is
>  > better when we try to use and why? 
>  > If not, Please give me some suggestion about the difference and when we
>  > should to use for them?
>  >    
>  
>  Not sure I understand the question.  I would say you want to change the
>  domain of the process or the context of the file to match the truth.
>  For example, if you have a file that needs to be shared by samba then it
>  is usually better to change the label to samba_share_t rather then run
>  the samba process as an unconfined process.
>  
>  But it is best for you to describe the exact problem that you are having
>  with SELinux 
 
[Su Heng:] I mean I have a folder path "/tmp/share_for_smb_www". I want
both of samba and httpd can access it. If I change the type of this
directory to "samba_share_t", httpd won't access it. At this time I have
to switch the type of this directory frequently. 
  As I know, RBAC can let more than one "Subject" to access the same
"Object". So, can a folder or file(Object) can have more than one type?
How selinux implements this? to use policy configure?


>  > 
>  > Thanks & Best Regards,
>  > Su Heng
>  > 
>  > 
>  > 
>  > 
>  > --
>  > selinux mailing list
>  > selinux(a)lists.fedoraproject.org
>  > https://admin.fedoraproject.org/mailman/listinfo/selinux
>  
> >  -----BEGIN PGP SIGNATURE-----
> >  Version: GnuPG v1.4.10 (GNU/Linux)
> >  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> >  
> >  iEYEARECAAYFAky8XhQACgkQrlYvE4MpobNZnACg2t5t/FhYW/Uu0qj2nSaabi2t
> >  p+4Ani7GbglSmdwsdBvwz2hrGVMRvrGW
> >  =25Nd
> >  -----END PGP SIGNATURE----- 
>  
Thanks & Best Regards,
Su Heng

-- 
QQ :    49757862
MSN:    suh.steven(a)hotmail.com
Mobile: [phone]

Seek for help

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/20/2010 07:48 AM, su heng wrote:
>  
>  Hi Daniel,
>  
>  	Thanks for your reply. Please see my remarks,Thanks.
>  
>  On Mon, 2010-10-18 at 10:47 -0400, Daniel J Walsh wrote:
>  On 10/19/2010 09:33 AM, su heng wrote:
> >>> Hi,
> >>>
> >>> I have two problem want to fix.
> >>>
> >>> Firstly,
> >>>
> >>> [root@localhost tmp]# mkdir test
> >>> [root@localhost tmp]# ls -dZ test
> >>> drwxr-xr-x. root root unconfined_u:object_r:user_tmp_t:s0 test
> >>> [root@localhost tmp]# semanage fcontext -a -t samba_share_t
> >>> "/tmp/test(/.*)?"
> >>> [root@localhost tmp]# restorecon -R -v /tmp/test/
> >>> restorecon reset /tmp/test context
> >>> unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:samba_share_t:s0
> >>> [root@localhost tmp]# ls -dZ test
> >>> drwxr-xr-x. root root system_u:object_r:samba_share_t:s0 test
> >>> ------------------------------------------------------------------
> >>> When I tried to delete the type, an error happened. 
> >>> [root@localhost tmp]# semanage fcontext -d /tmp/test/
> >>> Can't create lock file
> '/var/cache/abrt/pyhook-1287493825-3446.lock':
> >>> Permission denied
> >>> Traceback (most recent call last):
> >>>   File "/usr/sbin/semanage", line 501, in <module>
> >>>     process_args(sys.argv[1:])
> >>>   File "/usr/sbin/semanage", line 437, in process_args
> >>>     OBJECT.delete(target, ftype)
> >>>   File "/usr/lib/python2.6/site-packages/seobject.py", line 1623,
> in
> >>> delete
> >>>     self.__delete( target, ftype)
> >>>   File "/usr/lib/python2.6/site-packages/seobject.py", line 1594,
> in
> >>> __delete
> >>>     if target in self.equiv.keys():
> >>> AttributeError: fcontextRecords instance has no attribute 'equiv'
> >>>
> >>>
>  This looks like a bug in semanage
> > [Su Heng:] Which bug describe it and could u give me a URL as a
> > reference?
>  
I was suggesting that you report one.  This seems to work in F13 and beyond.

>  rpm -q policycoreutils
> > [Su Heng:] What is this line used for? I get a result under my shell:
> > [root@localhost suheng]# rpm -q policycoreutils
> > policycoreutils-2.0.74-4.fc12.i686
>   
Please attempt to yum -y update policycoreutils

To get newer version of policycoreutils.


>  
>  This line
>  # semanage fcontext -d /tmp/test/
>  
>  should be
>  # semanage fcontext -d "/tmp/test(/.*)?"
> > [Su Heng:] Yes, thanks, the same error still.
> > And I want know the solution for this issue. Could u give me some more
> > details to fix it?
>  
>  But it looks like you will still have the bug.
>  
> >>> And I have searched from Google, there is a bug has been reported. So I
> >>> update it to the latest selinux-policy. The error still. How should I
> >>> do?
> >>>
> >>> Secondly,
> >>>    I have read the document which resided on fedora site. I have a
> >>> question. 
> >>> We can change the type or the domain of a file or process which can let
> >>> us pass through the check of se-linux. 
> >>> And we also can write a policy file to pass through se-linux.
> >>>
> >>>    These two methods are the same destination? If so, which one is
> >>> better when we try to use and why? 
> >>> If not, Please give me some suggestion about the difference and when we
> >>> should to use for them?
> >>>    
>  
>  Not sure I understand the question.  I would say you want to change the
>  domain of the process or the context of the file to match the truth.
>  For example, if you have a file that needs to be shared by samba then it
>  is usually better to change the label to samba_share_t rather then run
>  the samba process as an unconfined process.
>  
>  But it is best for you to describe the exact problem that you are having
>  with SELinux
>  
> > [Su Heng:] I mean I have a folder path "/tmp/share_for_smb_www". I want
> > both of samba and httpd can access it. If I change the type of this
> > directory to "samba_share_t", httpd won't access it. At this time I
> have
> > to switch the type of this directory frequently. 
> >   As I know, RBAC can let more than one "Subject" to access the same
> > "Object". So, can a folder or file(Object) can have more than one type?
> > How selinux implements this? to use policy configure?
>  
>  
> >>>
> >>> Thanks & Best Regards,
> >>> Su Heng
> >>>
> >>>
> >>>
> >>>
> >>> --
> >>> selinux mailing list
> >>> selinux(a)lists.fedoraproject.org
> >>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>   
>  Thanks & Best Regards,
>  Su Heng 

You want to set the context to public_content_t or public_content_rw_t
if you want one of apache or samba to have write access.

man samba_selinux
man httpd_selinux

Will excplain this.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>
> iEYEARECAAYFAky9mXIACgkQrlYvE4MpobMG4QCg4YPylHXGJGzC4h9Yf5/ZrPph
> EpIAnAyK3StIB18a4Lwqtk+ncuPTdhUZ
> =BrZW
> -----END PGP SIGNATURE-----

Seek for help

[su heng]

Hi Daniel,

   Thanks a lot. Your solution has fixed the issue about delete type of
my file or directory.
   And thank you for suggesting read man selinux of httpd and samaba.

Thanks & Best Regards,
Su Heng

On Tue, 2010-10-19 at 09:13 -0400, Daniel J Walsh wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>  
>  On 10/20/2010 07:48 AM, su heng wrote:
>  > 
>  > Hi Daniel,
>  > 
>  > 	Thanks for your reply. Please see my remarks,Thanks.
>  > 
>  > On Mon, 2010-10-18 at 10:47 -0400, Daniel J Walsh wrote:
>  > On 10/19/2010 09:33 AM, su heng wrote:
>  >>>> Hi,
>  >>>>
>  >>>> I have two problem want to fix.
>  >>>>
>  >>>> Firstly,
>  >>>>
>  >>>> [root@localhost tmp]# mkdir test
>  >>>> [root@localhost tmp]# ls -dZ test
>  >>>> drwxr-xr-x. root root unconfined_u:object_r:user_tmp_t:s0 test
>  >>>> [root@localhost tmp]# semanage fcontext -a -t samba_share_t
>  >>>> "/tmp/test(/.*)?"
>  >>>> [root@localhost tmp]# restorecon -R -v /tmp/test/
>  >>>> restorecon reset /tmp/test context
>  >>>>
> unconfined_u:object_r:user_tmp_t:s0->system_u:object_r:samba_share_t:s0
>  >>>> [root@localhost tmp]# ls -dZ test
>  >>>> drwxr-xr-x. root root system_u:object_r:samba_share_t:s0 test
>  >>>> ------------------------------------------------------------------
>  >>>> When I tried to delete the type, an error happened. 
>  >>>> [root@localhost tmp]# semanage fcontext -d /tmp/test/
>  >>>> Can't create lock file
> '/var/cache/abrt/pyhook-1287493825-3446.lock':
>  >>>> Permission denied
>  >>>> Traceback (most recent call last):
>  >>>>   File "/usr/sbin/semanage", line 501, in <module>
>  >>>>     process_args(sys.argv[1:])
>  >>>>   File "/usr/sbin/semanage", line 437, in process_args
>  >>>>     OBJECT.delete(target, ftype)
>  >>>>   File "/usr/lib/python2.6/site-packages/seobject.py", line
> 1623, in
>  >>>> delete
>  >>>>     self.__delete( target, ftype)
>  >>>>   File "/usr/lib/python2.6/site-packages/seobject.py", line
> 1594, in
>  >>>> __delete
>  >>>>     if target in self.equiv.keys():
>  >>>> AttributeError: fcontextRecords instance has no attribute
> 'equiv'
>  >>>>
>  >>>>
>  > This looks like a bug in semanage
>  >> [Su Heng:] Which bug describe it and could u give me a URL as a
>  >> reference?
>  >
>  I was suggesting that you report one.  This seems to work in F13 and beyond.
>  
>  > rpm -q policycoreutils
>  >> [Su Heng:] What is this line used for? I get a result under my shell:
>  >> [root@localhost suheng]# rpm -q policycoreutils
>  >> policycoreutils-2.0.74-4.fc12.i686
>  > 
>  Please attempt to yum -y update policycoreutils
>  
>  To get newer version of policycoreutils.
>  
>  
>  > 
>  > This line
>  > # semanage fcontext -d /tmp/test/
>  > 
>  > should be
>  > # semanage fcontext -d "/tmp/test(/.*)?"
>  >> [Su Heng:] Yes, thanks, the same error still.
>  >> And I want know the solution for this issue. Could u give me some more
>  >> details to fix it?
>  > 
>  > But it looks like you will still have the bug.
>  > 
>  >>>> And I have searched from Google, there is a bug has been reported. So I
>  >>>> update it to the latest selinux-policy. The error still. How should I
>  >>>> do?
>  >>>>
>  >>>> Secondly,
>  >>>>    I have read the document which resided on fedora site. I have a
>  >>>> question. 
>  >>>> We can change the type or the domain of a file or process which can let
>  >>>> us pass through the check of se-linux. 
>  >>>> And we also can write a policy file to pass through se-linux.
>  >>>>
>  >>>>    These two methods are the same destination? If so, which one is
>  >>>> better when we try to use and why? 
>  >>>> If not, Please give me some suggestion about the difference and when we
>  >>>> should to use for them?
>  >>>>    
>  > 
>  > Not sure I understand the question.  I would say you want to change the
>  > domain of the process or the context of the file to match the truth.
>  > For example, if you have a file that needs to be shared by samba then it
>  > is usually better to change the label to samba_share_t rather then run
>  > the samba process as an unconfined process.
>  > 
>  > But it is best for you to describe the exact problem that you are having
>  > with SELinux
>  > 
>  >> [Su Heng:] I mean I have a folder path "/tmp/share_for_smb_www". I
> want
>  >> both of samba and httpd can access it. If I change the type of this
>  >> directory to "samba_share_t", httpd won't access it. At this time
> I have
>  >> to switch the type of this directory frequently. 
>  >>   As I know, RBAC can let more than one "Subject" to access the same
>  >> "Object". So, can a folder or file(Object) can have more than one
> type?
>  >> How selinux implements this? to use policy configure?
>  > 
>  > 
>  >>>>
>  >>>> Thanks & Best Regards,
>  >>>> Su Heng
>  >>>>
>  >>>>
>  >>>>
>  >>>>
>  >>>> --
>  >>>> selinux mailing list
>  >>>> selinux(a)lists.fedoraproject.org
>  >>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>  > 
>  
>  > Thanks & Best Regards,
>  > Su Heng
>  
>  
>  You want to set the context to public_content_t or public_content_rw_t
>  if you want one of apache or samba to have write access.
>  
>  man samba_selinux
>  man httpd_selinux
>  
>  Will excplain this.
> >  -----BEGIN PGP SIGNATURE-----
> >  Version: GnuPG v1.4.10 (GNU/Linux)
> >  Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> >  
> >  iEYEARECAAYFAky9mXIACgkQrlYvE4MpobMG4QCg4YPylHXGJGzC4h9Yf5/ZrPph
> >  EpIAnAyK3StIB18a4Lwqtk+ncuPTdhUZ
> >  =BrZW
> >  -----END PGP SIGNATURE----- 
>  
-- 
QQ :    49757862
MSN:    suh.steven(a)hotmail.com
Mobile: [phone]