When learning SELinux, I executed semanage fcontext -l > fcontext.txt under /root directory to dump massive fcontext information to a file. The funny result is: fcontext.txt was created, but the size of it is 0.

I asked in #fedora-selinux IRC channel, a Fedora QA told me try change the type of SELinux context of fcontext.txt to semanage_tmp_t. It works finally.

But what still confusing me is:

Which process/program create/write the standard output to the redirected file ? (so that SELinux targetd policy should applied to that process/program)

  • The bash shell ? /bin/bash
  • or semanage (it's a python script) ? /usr/sbin/semanage
  • or the interpreter - python ? /usr/bin/python

I thought it should be the bash shell, because I/O redirection is controlled by shell (right?), not the program itself. so semanage/python didn't create the file directly.

  • btw, pipe works fine, semanage fcontext -l | cat > fcontext.txt will fill the fcontext.txt file – LiuYan 刘研 Jun 8 '11 at 10:01

You're right: redirection for input and output streams is done by the shell.

In more detail, when you execute a command through the shell the following procedure is run:

  1. The shell forks to create a new process.

  2. The newly-created shell ("child" shell) applies redirections: it opens the file specified as output target (resp. input source) and sets it as the new STDOUT (resp. STDIN) stream (using the dup2 system call).

  3. The"child" shell execs the command you asked to run, using the execve(2) system call, which replaces the shell process with a new program.

| improve this answer | |
  • thanks, this explains why the file was created (step 2), but no contents were written (step 3) if SELinux=Enforcing. – LiuYan 刘研 Jun 8 '11 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.