2

I'm having trouble finding information on what command, presumably from setools, I should use to find all the files on my filesystem that are labeled by SELinux with a certain file-context (fcontext).


At the moment, I can manually list the files along with their respective fcontexts from the file /etc/selinux/targeted/contexts/files, and then grep the specific fcontext I'd like to see.

[root@FedPadSSD files]# cat file_contexts |grep ifconfig_exec_t
/bin/ip --      system_u:object_r:ifconfig_exec_t:s0
/sbin/ip        --      system_u:object_r:ifconfig_exec_t:s0
/sbin/tc        --      system_u:object_r:ifconfig_exec_t:s0
/usr/bin/ip     --      system_u:object_r:ifconfig_exec_t:s0
/usr/sbin/ip    --      system_u:object_r:ifconfig_exec_t:s0
/usr/sbin/tc    --      system_u:object_r:ifconfig_exec_t:s0
/sbin/ethtool   --      system_u:object_r:ifconfig_exec_t:s0
/sbin/ifconfig  --      system_u:object_r:ifconfig_exec_t:s0
/sbin/iwconfig  --      system_u:object_r:ifconfig_exec_t:s0
/sbin/mii-tool  --      system_u:object_r:ifconfig_exec_t:s0
/usr/sbin/ethtool       --      system_u:object_r:ifconfig_exec_t:s0
/usr/sbin/ifconfig      --      system_u:object_r:ifconfig_exec_t:s0
/usr/sbin/iwconfig      --      system_u:object_r:ifconfig_exec_t:s0
/usr/sbin/mii-tool      --      system_u:object_r:ifconfig_exec_t:s0
/sbin/ipx_configure     --      system_u:object_r:ifconfig_exec_t:s0
/sbin/ipx_interface     --      system_u:object_r:ifconfig_exec_t:s0
/sbin/ipx_internal_net  --      system_u:object_r:ifconfig_exec_t:s0
/usr/sbin/ipx_configure --      system_u:object_r:ifconfig_exec_t:s0
/usr/sbin/ipx_interface --      system_u:object_r:ifconfig_exec_t:s0
/usr/sbin/ipx_internal_net      --      system_u:object_r:ifconfig_exec_t:s0

The problem with this is that, it seems, most of the time there's something wrong or missing/incomplete when you do it manually as it relates to the SELinux "database" (for lack of a better word). So, I wonder if something already exists in the setools package, or related packages, that accomplishes this without having to fuss around with the system-wide configuration files.

  • 2
    You might need to do a find / -type f -exec ls -lZ {} \; and grep that output you the file context you're searching for. That file you're looking at is for persistent mappings. If someone did a chcon it won't reflect the file's current context, just what it'll revert to if you did a restorecon – Bratchley Dec 13 '14 at 0:31
  • GNU ls will list file contexts with -Z. – mikeserv Dec 13 '14 at 0:32
  • Thanks Joel for pointing out the issue with "persistence". mikeserv: yes, I'm aware of the -Z flag for ls; I could also do something like ls -alZR / |grep ifconfig_exec_t However, I was wondering if there's a more "official" way to do this with the proper tools dealing with SELinux. – ILMostro_7 Dec 13 '14 at 0:39
3

semanage fcontext -l | grep whatever_exec_t is probably the best way to find labeling rules for specific context.

If you wish to search for current file contexts instead of labeling rules, you can use ls -Z, but SELinux-aware find supports -context <glob> test and %Z format specifier for -printf. Note that whole context string is matched against <glob>, so use wildcards when matching against type only. Example on my Centos 7.3:

#find / -xdev -type f -context '*ifconfig_exec_t*' -printf '%-50Z%p\n'
system_u:object_r:ifconfig_exec_t:s0              /usr/sbin/ip
unconfined_u:object_r:ifconfig_exec_t:s0          /usr/sbin/ifconfig
system_u:object_r:ifconfig_exec_t:s0              /usr/sbin/ethtool
system_u:object_r:ifconfig_exec_t:s0              /usr/sbin/iw
unconfined_u:object_r:ifconfig_exec_t:s0          /usr/sbin/mii-tool
system_u:object_r:ifconfig_exec_t:s0              /usr/sbin/tc
1

If your distro packages the ifconfig_selinux man page (Fedora has it in selinux-policy-devel), it'll tell you:

   The following file types are defined for ifconfig:

   ifconfig_exec_t

   - Set files with the ifconfig_exec_t type, if you want to transition an
   executable to the ifconfig_t domain.

   Paths:
        /bin/ip,    /sbin/ip,    /sbin/tc,    /usr/bin/ip,   /usr/sbin/ip,
        /usr/sbin/tc,   /sbin/ethtool,   /sbin/ifconfig,   /sbin/iwconfig,
        /sbin/mii-tool,       /usr/sbin/ethtool,       /usr/sbin/ifconfig,
        /usr/sbin/iwconfig,    /usr/sbin/mii-tool,    /sbin/ipx_configure,
        /sbin/ipx_interface, /sbin/ipx_internal_net, /usr/sbin/ipx_config‐
        ure, /usr/sbin/ipx_interface, /usr/sbin/ipx_internal_net

You can also use sesearch -all -t ifconfig_exec_t to see what transitions operate on files with a target of ifconfig_exec_t, which might help you find files with that context.

  • Thanks for the reply; I thought there might be a more descernable method with sesearch, but I've only been able to use it as you suggested so far. It might be a nice feature to add to the setools – ILMostro_7 Dec 15 '14 at 1:16
0

At the moment on RHEL7.1--I'm not sure if this has always been there and I missed it--I can execute the following to get a list of all the filecontexts and just pipe the output to grep:

# semanage fcontext -l |grep ifconfig_exec_t
/bin/ip                                            regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/ethtool                                      regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/ifconfig                                     regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/ip                                           regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/ipx_configure                                regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/ipx_interface                                regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/ipx_internal_net                             regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/iw                                           regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/iwconfig                                     regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/mii-tool                                     regular file       system_u:object_r:ifconfig_exec_t:s0 
/sbin/tc                                           regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/bin/ip                                        regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/ethtool                                  regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/ifconfig                                 regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/ip                                       regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/ipx_configure                            regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/ipx_interface                            regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/ipx_internal_net                         regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/iw                                       regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/iwconfig                                 regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/mii-tool                                 regular file       system_u:object_r:ifconfig_exec_t:s0 
/usr/sbin/tc                                       regular file       system_u:object_r:ifconfig_exec_t:s0
0

The find command allows you to search by security context.

For example, let's search for all files of the type "unlabeled_t".

find / -type f -context *unlabeled_t*

The first part, "find / -type f," tells us to search all regular files on the system.

"-context *unlabeled_t*" filters to show us all files of type unlabeled_t. We have to wildcard the beginning and end, because we don't care about the user/role at the beginning, or the MLS/MCS context at the end.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.