Re: Easy way to remove SELinux permissions?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Daniel J Walsh wrote:
> On 09/10/2009 11:19 AM, Stephen Smalley wrote:
>> I think what is happening is this:  gedit has been instrumented to
>> preserve the security.selinux attribute on files.  This works fine when
>> SELinux is enabled, as SELinux applies a set of permission checks on
>> setting its attributes and does not require a Linux capability /
>> superuser access in doing so.  But when SELinux is disabled, setting any
>> attribute in the security.* namespace is restricted to CAP_SYS_ADMIN and
>> thus non-root use of gedit will fail on the setxattr() call with EPERM.
>>
> I would say that gedit should check SELinux enfocing mode and if
> disabled continue to work.
> 
I would expect it to check errno when the call to setxattr fails. It
can fail for other reasons then a SELinux error.

From the setxattr man page:

RETURN VALUE
       On success, zero is returned. On failure, -1 is returned and
       errno is set appropriately.

       If XATTR_CREATE is specified, and the attribute exists
       already, errno is set to EEXIST. If XATTR_REPLACE is
       specified, and the  attribute does not exist, errno is set to
       ENOATTR.

       If there is insufficient space remaining to store the
       extended attribute, errno is set to either ENOSPC, or EDQUOT
       if quota enforcement was the cause.

       If extended attributes are not supported by the filesystem,
       or are disabled, errno is set to ENOTSUP.

       The errors documented for the stat(2) system call are  also
       applicable here.

So if errno is ENOTSUP, I would expect gedit to continue without
generating an error. It should probably do the same for EEXIST and
ENOATTR...

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

Attachment: signature.asc
Description: OpenPGP digital signature

-- 
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines

[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux