make relabel > restorecon

[Steve Brueckner]

Daniel J Walsh wrote:
> Steve Brueckner wrote:
>> Daniel J Walsh wrote:
>>> Steve Brueckner wrote:
>>>> I have a file
>>>> /etc/selinux/targeted/src/policy/file_contexts/programs/tspi_dillo.fc
>>>> that contains the following line only:
>>>> 
>>>> /tspi/usr/local/bin/dillo	--	system_u:object_r:tspi_dillo_exec_t
>>>> 
>>>> When I do # make reload and then # make relabel the system
>>>> correctly labels the file and adds the above line to the master
>>>> file_contexts file. 
>>>> 
>>>> However, if I then run # /sbin/restorecon /tspi/usr/local/bin/dillo
>>>> the file's type reverts to default_t
>>>> 
>>>> Any ideas on why this is happening?
>>>> 
>>> I take it you have a domains/program/tspi_dillo.te file?
>>> 
>>> grep dillo /etc/selinux/targeted/context/files/*
>>> 
>> Yes, I have
>> /etc/selinux/targeted/src/policy/domains/program/tspi_dillo.te
>> which declares the tspi_dillo_exec_t.
>> 
>> However, I think your grep showed me where the problem lies.  There
>> are two file_contexts files:
>> /etc/selinux/targeted/src/policy/file_contexts/file_contexts
>> /etc/selinux/targeted/context/files/file_contexts 
>> 
>> And a diff shows that the former has the context for dillo and the
>> latter does not.  I was apparently mistaken earlier when I said that
>> the "master" file_contexts file contains the line in question.
>> 
>> So my question now becomes how does the former get updated?  I've
>> done make reload and make relabel but it seems that neither is
>> updating /etc/selinux/targeted/context/files/file_contexts.
>> 
> That is strange.  Make reload should have copied the your
> file_context over. 
> 
> Try make -W users load
> See if the file_context gets replaced.  Any chance of clock skew on
> your machine.

Fooling make into thinking users had been updated did the trick, thanks.  My
clock, logs, and file times all look fine, so I don't think clock skew is
the problem.

I am, however, running (last week's) rawhide SELinux and rawhide kernel on
an othewise FC3 install, so maybe there's something not meshing in there.
Am I correct in thinking that the rawhide SELinux packages are currently
being written and tested on FC4?

Anyway, I appreciate the assist.

 - Steve Brueckner, ATC-NY