Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modify path for arping in netutils.fc to match both bin and sbin #341

Merged
merged 1 commit into from Apr 3, 2020

Conversation

zpytela
Copy link
Contributor

@zpytela zpytela commented Apr 3, 2020

In iputils newer than iputils-20180629 the arping command moved from
/sbin to /bin, hence the path in the netutils.fc file needs to be
adjusted so that it matches both possible paths for the actual file.
Symlink can have bin_t assigned.

Resolves: rhbz#1820191

In iputils newer than iputils-20180629 the arping command moved from
/sbin to /bin, hence the path in the netutils.fc file needs to be
adjusted so that it matches both possible paths for the actual file.
Symlink can have bin_t assigned.

Resolves: rhbz#1820191
@zpytela
Copy link
Contributor Author

zpytela commented Apr 3, 2020

Applicable to F31 and newer.

@wrabcak
Copy link
Member

wrabcak commented Apr 3, 2020

I'm confused by commit msg. You want to label /bin/arping as netutils_exec_t and keep /sbin/arping labeled as bin_t ?
If yes, then it's confusing also in netutils.fc file because you're trying to label /sbin/arping and /bin/arping as netutils_exec_t but specifying only files (not symlink therefore /bin/arping is bin_t). Do I understand it correctly?

@zpytela
Copy link
Contributor Author

zpytela commented Apr 3, 2020

The goal was to label plain files regardless of iputils version and therefore regardless of the path. Symlinks are correct to have the default bin_t.

@wrabcak
Copy link
Member

wrabcak commented Apr 3, 2020

Good. Just to complete the msg: domain attribute can read symlinks labeled as bin_t . So there is no need to allow it for netutils_t .

LGTM.
Thanks.

@wrabcak wrabcak merged commit dad6a80 into fedora-selinux:rawhide Apr 3, 2020
@zpytela zpytela deleted the fb-arping-path branch April 3, 2020 10:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants