6

I just created a blank conf file for freetds and noticed that the permissions are wrong:

[root@box etc]# touch freetds.conf.new
[root@box etc]# ll -lZ freetds.conf*
-rw-r--r--. root root system_u:object_r:etc_t:s0   freetds.conf
-rw-rw----. root root unconfined_u:object_r:etc_t:s0   freetds.conf.new

So I tried:

[root@box]# semanage fcontext -a -t system_u /etc/freetds.conf.new 

But this fails with:

ValueError: Type system_u is invalid, must be a file or device type

What should I use to change the label from unconfined_u to system_u on the file freetds.conf.new?

12

A "temporary" label change is done via the chcon command:

bash-4.2# touch freetds.conf.new
bash-4.2# ls -lZ freetds.conf.new
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   freetds.conf.new
bash-4.2# chcon -t etc_t -u system_u freetds.conf.new 
bash-4.2# ls -lZ freetds.conf.new
-rw-r--r--. root root system_u:object_r:etc_t:s0       freetds.conf.new

A permanent change would be done via the semanage command. This will add (or modify) a line in /etc/selinux/targeted/contexts/files/file_contexts.local which can then be applied with restorecon.

So, let's start again with a new file:

bash-4.2# rm freetds.conf.new
bash-4.2# touch freetds.conf.new
bash-4.2# ls -lZ freetds.conf.new
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   freetds.conf.new

We can add a rule for this:

bash-4.2# semanage fcontext -a -t etc_t -s system_u /etc/freetds.conf.new
bash-4.2# cat /etc/selinux/targeted/contexts/files/file_contexts.local
# This file is auto-generated by libsemanage
# Do not edit directly.

/etc/freetds.conf.new    system_u:object_r:etc_t:s0

This hasn't changed the file yet, though

bash-4.2# ls -lZ freetds.conf.new
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   freetds.conf.new

So now we apply it:

bash-4.2# restorecon -vF /etc/freetds.conf.new
restorecon reset /etc/freetds.conf.new context unconfined_u:object_r:etc_t:s0->system_u:object_r:etc_t:s0
bash-4.2# ls -lZ /etc/freetds.conf.new
-rw-r--r--. root root system_u:object_r:etc_t:s0       /etc/freetds.conf.new

ETA: If you're going to copy the freetds.conf.new to freetds.conf after you've updated it then I'd probably stick with the chcon command; it's easier and the existing ruleset will handle relabeling when it has the right name. I'd only use the semanage form if this is to be the final name.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.