Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 930128 - Do not hard-link files in webapp.eclass, if selinux is enabled
Summary: Do not hard-link files in webapp.eclass, if selinux is enabled
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: SE Linux Bugs
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-17 06:31 UTC by Alexander Weber
Modified: 2024-04-17 06:31 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Weber 2024-04-17 06:31:04 UTC 
Hard-Links shares the same selinux labels. Therefore trouble exists if you need to relabel the system.

Reproducible: Always

Steps to Reproduce:
1. Install any webapp on selinux secured system
2. restorecon -RFv /usr/share/webapps
3. restorecon -RFv /var/www/localhost/htdocs/
Actual Results:  
1) The first restorecon changes the most labels to system_u:object_r:usr_t
Example: 
Relabeled /usr/share/webapps/baikal/0.9.3/htdocs/.htaccess from system_u:object_r:httpd_sys_content_t to system_u:object_r:usr_t

2) Second relabel change the label to "httpd" one:
Example: 
Relabeled /var/www/localhost/htdocs/baikal/.htaccess from system_u:object_r:usr_t to system_u:object_r:httpd_sys_content_t

Expected Results:  
The files should not be hard-linked.
The /usr/share/webapps/ files should remain system_u:object_r:usr_t
The /var/www/localhost/htdocs files should remain "httpd_*"