On 5/8/19 1:05 PM, mark wrote:
Thomas wrote:
> Imho: longest path match wins.
>
>
> can you show your fcontext rules regarding that directory?
>
> tip: with `matchpathcon /path/...` you can try any path what context it
> would get (existing or not (yet) existing paths) without changing
> anything on the fs.
>
Ah, thanks. Did that, and the /<path>/smwa/webagent/bin is bin_t. Now,
that might be right... but the idiots of CA, who only know Windows, do not
have a ./lib, and all the .so's are in the bin directory... Am I going to
have to live with that?
Fully specified pathnames (i.e. no regexes) win. But locally-added file
contexts entries should take precedence over system-provided ones anyway
IIRC. What does setfiles -d
/etc/selinux/targeted/contexts/files/file_contexts
/<path>/smwa/webagent/bin/foo.so report? Note by the way that your
regex only matches things that end in .so, so /path/smwa/webagent/bin
itself wouldn't match. Also note that you should escape the dot (\.so)
if you want it literally and not the regex match-any character.
mark
> Am 8. Mai 2019 17:37:52 MESZ schrieb mark <m.roth(a)5-cent.us>:
>
>> Thomas wrote:
>>
>>> there is no - for the fcontext action.
>>>
>>> semanage fcontext ...
>>>
>> Duh... Yeah, a few minutes after I posted, I realized that, and it
>> *seemed* to work. But now, I've got a different issue: I did a
>> restorecon -rv /*/smwa/webagent/bin... and now all the .so's are bin_t,
>> instead of lib_t
>>
>>
>>> thomas
>>>
>>> Am 8. Mai 2019 17:31:13 MESZ schrieb mark <m.roth(a)5-cent.us>:
>>>
>>>
>>>> We're forced to use Siteminder, by CA, who have no clue what
>>>> they're doing in *nix. No packages, tarballs...
>>>>
>>>> Anyway, I'm trying clean up some stuff, and in /*/smwa/webagent/bin
>>>> (all
>>>> their binaries, including .so's, are in there, duh... I'm trying
to
>> set
>>>> the .so's to lib_t. semanage -fcontext -a -t lib_t
>>>> "/<elided>/smwa/webagent/bin(/.*).so"
>>>>
>>>>
>>>>
>>>> gives me the completely unexpected response of semanage: error:
>> argument
>>>> subcommand: invalid choice: 'lib_t' (choose
>>>> from 'import', 'export', 'login', 'user',
'port', 'ibpkey',
>> 'ibendport',
>>
>>>> 'interface', 'module', 'node',
'fcontext', 'boolean', 'permissive',
>>>> 'dontaudit')
>>>>
>>>>
>>>>
>>>> What am I doing wrong?
>>>>
>>>>
>>>>
>>>> mark
>>>>
>>>> _______________________________________________
>>>> selinux mailing list -- selinux(a)lists.fedoraproject.org To
>> unsubscribe
>>>> send an email to selinux-leave(a)lists.fedoraproject.org Fedora Code
>> of
>>>> Conduct:
https://getfedora.org/code-of-conduct.html
>>>> List Guidelines:
>>>>
>>
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>
>>>> List Archives:
>>>>
>>>>
>>
https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproje
>> c
>>>> t.org
>>> _______________________________________________
>>> selinux mailing list -- selinux(a)lists.fedoraproject.org To
>> unsubscribe send
>>> an email to selinux-leave(a)lists.fedoraproject.org Fedora Code of
>> Conduct:
>>
>>>
https://getfedora.org/code-of-conduct.html
>>> List Guidelines:
>>>
>>
https://fedoraproject.org/wiki/Mailing_list_guidelines
>>
>>> List Archives:
>>>
>>>
>>
https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproje
>> ct
>>> .org
>>>
>>>
>>>
>
_______________________________________________
selinux mailing list -- selinux(a)lists.fedoraproject.org
To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject...