Bug 930128

Summary:	Do not hard-link files in webapp.eclass, if selinux is enabled
Product:	Gentoo Linux	Reporter:	Alexander Weber <web.alexander>
Component:	SELinux	Assignee:	SE Linux Bugs <selinux>
Status:	UNCONFIRMED ---
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Alexander Weber 2024-04-17 06:31:04 UTC

Hard-Links shares the same selinux labels. Therefore trouble exists if you need to relabel the system.

Reproducible: Always

Steps to Reproduce:
1. Install any webapp on selinux secured system
2. restorecon -RFv /usr/share/webapps
3. restorecon -RFv /var/www/localhost/htdocs/
Actual Results:  
1) The first restorecon changes the most labels to system_u:object_r:usr_t
Example: 
Relabeled /usr/share/webapps/baikal/0.9.3/htdocs/.htaccess from system_u:object_r:httpd_sys_content_t to system_u:object_r:usr_t

2) Second relabel change the label to "httpd" one:
Example: 
Relabeled /var/www/localhost/htdocs/baikal/.htaccess from system_u:object_r:usr_t to system_u:object_r:httpd_sys_content_t

Expected Results:  
The files should not be hard-linked.
The /usr/share/webapps/ files should remain system_u:object_r:usr_t
The /var/www/localhost/htdocs files should remain "httpd_*"