Easy way to remove SELinux permissions?
At one point I performed a new Fedora install and restored my personal files before disabling SELinux which I don't need. As a result many files have permissions which include a dot at the end, e.g.: -rw-rw-r--. This causes havoc with many applications, i.e. gedit complains it cannot make a back-up file. Q: How can I EASILY remove all SELinux attributes, e.g. perhaps with a single command? Best regards, Sean Carlos -- __ Blog: www.antezeta.it/blog www.antezeta.com/blog -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
Re: Easy way to remove SELinux permissions?
On Thu, 2009-09-10 at 07:58 +0200, Sean Carlos wrote:
> At one point I performed a new Fedora install and restored my personal
> files before disabling SELinux which I don't need.
>
> As a result many files have permissions which include a dot at the end,
> e.g.:
>
> -rw-rw-r--.
>
> This causes havoc with many applications, i.e. gedit complains it cannot
> make a back-up file.
>
> Q: How can I EASILY remove all SELinux attributes, e.g. perhaps with a
> single command?
If SELinux is disabled, then you should be able to do this:
find / -exec setfattr -x security.selinux {} \;
You might want to further qualify the find statement to avoid noise on
filesystems that don't support security contexts, e.g.
find / \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype btrfs \)
-exec setfattr -x security.selinux {} \;
--
Stephen Smalley
National Security Agency
--
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
Re: Easy way to remove SELinux permissions?
On 09/10/2009 01:58 AM, Sean Carlos wrote: > > At one point I performed a new Fedora install and restored my personal > files before disabling SELinux which I don't need. > > As a result many files have permissions which include a dot at the end, > e.g.: > > -rw-rw-r--. > > This causes havoc with many applications, i.e. gedit complains it cannot > make a back-up file. Open a bugzilla on this. Having an extended attribute should not cause gedit to work to fail. > > Q: How can I EASILY remove all SELinux attributes, e.g. perhaps with a > single command? > > Best regards, > > Sean Carlos -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
Re: Easy way to remove SELinux permissions?
On Thu, 2009-09-10 at 10:58 -0400, Daniel J Walsh wrote: > On 09/10/2009 01:58 AM, Sean Carlos wrote: > > > > At one point I performed a new Fedora install and restored my personal > > files before disabling SELinux which I don't need. > > > > As a result many files have permissions which include a dot at the end, > > e.g.: > > > > -rw-rw-r--. > > > > This causes havoc with many applications, i.e. gedit complains it cannot > > make a back-up file. > Open a bugzilla on this. Having an extended attribute should not cause gedit > to work to fail. I think what is happening is this: gedit has been instrumented to preserve the security.selinux attribute on files. This works fine when SELinux is enabled, as SELinux applies a set of permission checks on setting its attributes and does not require a Linux capability / superuser access in doing so. But when SELinux is disabled, setting any attribute in the security.* namespace is restricted to CAP_SYS_ADMIN and thus non-root use of gedit will fail on the setxattr() call with EPERM. -- Stephen Smalley National Security Agency -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
Re: Easy way to remove SELinux permissions?
Stephen Smalley wrote the following on 09/10/2009 02:57 PM:
On Thu, 2009-09-10 at 07:58 +0200, Sean Carlos wrote:
At one point I performed a new Fedora install and restored my personal
files before disabling SELinux which I don't need.
As a result many files have permissions which include a dot at the end,
e.g.:
-rw-rw-r--.
This causes havoc with many applications, i.e. gedit complains it cannot
make a back-up file.
Q: How can I EASILY remove all SELinux attributes, e.g. perhaps with a
single command?
If SELinux is disabled, then you should be able to do this:
find / -exec setfattr -x security.selinux {} \;
You might want to further qualify the find statement to avoid noise on
filesystems that don't support security contexts, e.g.
find / \( -fstype ext2 -o -fstype ext3 -o -fstype ext4 -o -fstype btrfs \)
-exec setfattr -x security.selinux {} \;
This works perfectly - thanks!
--
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
Re: Easy way to remove SELinux permissions?
On 09/10/2009 11:19 AM, Stephen Smalley wrote: > On Thu, 2009-09-10 at 10:58 -0400, Daniel J Walsh wrote: >> On 09/10/2009 01:58 AM, Sean Carlos wrote: >>> >>> At one point I performed a new Fedora install and restored my personal >>> files before disabling SELinux which I don't need. >>> >>> As a result many files have permissions which include a dot at the end, >>> e.g.: >>> >>> -rw-rw-r--. >>> >>> This causes havoc with many applications, i.e. gedit complains it cannot >>> make a back-up file. >> Open a bugzilla on this. Having an extended attribute should not cause >> gedit to work to fail. > > I think what is happening is this: gedit has been instrumented to > preserve the security.selinux attribute on files. This works fine when > SELinux is enabled, as SELinux applies a set of permission checks on > setting its attributes and does not require a Linux capability / > superuser access in doing so. But when SELinux is disabled, setting any > attribute in the security.* namespace is restricted to CAP_SYS_ADMIN and > thus non-root use of gedit will fail on the setxattr() call with EPERM. > I would say that gedit should check SELinux enfocing mode and if disabled continue to work. -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
Re: Easy way to remove SELinux permissions?
Daniel J Walsh wrote: > On 09/10/2009 11:19 AM, Stephen Smalley wrote: >> I think what is happening is this: gedit has been instrumented to >> preserve the security.selinux attribute on files. This works fine when >> SELinux is enabled, as SELinux applies a set of permission checks on >> setting its attributes and does not require a Linux capability / >> superuser access in doing so. But when SELinux is disabled, setting any >> attribute in the security.* namespace is restricted to CAP_SYS_ADMIN and >> thus non-root use of gedit will fail on the setxattr() call with EPERM. >> > I would say that gedit should check SELinux enfocing mode and if > disabled continue to work. > I would expect it to check errno when the call to setxattr fails. It can fail for other reasons then a SELinux error. From the setxattr man page: RETURN VALUE On success, zero is returned. On failure, -1 is returned and errno is set appropriately. If XATTR_CREATE is specified, and the attribute exists already, errno is set to EEXIST. If XATTR_REPLACE is specified, and the attribute does not exist, errno is set to ENOATTR. If there is insufficient space remaining to store the extended attribute, errno is set to either ENOSPC, or EDQUOT if quota enforcement was the cause. If extended attributes are not supported by the filesystem, or are disabled, errno is set to ENOTSUP. The errors documented for the stat(2) system call are also applicable here. So if errno is ENOTSUP, I would expect gedit to continue without generating an error. It should probably do the same for EEXIST and ENOATTR... Mikkel -- Do not meddle in the affairs of dragons, for thou art crunchy and taste good with Ketchup! signature.asc Description: OpenPGP digital signature -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines
