labelling issues

[Stephen Smalley]

On Wed, 2004-12-08 at 18:27, Joe Orton wrote:
> On Fri, Dec 03, 2004 at 08:42:18AM -0500, Stephen Smalley wrote:
> > BTW, ask people who encounter the mislabeled shared objects to check
> > their /var/log/prelink.log for errors, particularly "Could not get
> > security context" or "Could not set security context", as prelink is
> > supposed to log those errors when it cannot get or set the file context.
> 
> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=142319
> 
> is that any use?

The 'ls' output indicates that the libpcre shared object is labeled
correctly, so I wonder if he had already relabeled it via fixfiles or
restorecon prior to running that ls.

The prelink.log file does include some 'Could not get security context"
errors (with errno ENODATA), which is interesting, but peculiar that
there is no such error for the libpcre shared object, since that is the
one that is triggering this denial.  The lack of any context on those
files is very odd unless he ran with SELinux disabled for a while (in
which case the files would indeed end up with no context if they were
updated while SELinux was disabled and he failed to relabel when he
re-enabled SELinux).

-- 
Stephen Smalley <sds at epoch.ncsc.mil>
National Security Agency