1

I'm setting up a Fedora (Core) 24 system from scratch, and ran into this oddness:

> sudo attr -l .
Attribute "selinux" has a 41 byte value for .

> sudo attr -g selinux .
attr_get: No data available
Could not get "selinux" for .

(similar for files other than ".", the current directory, I just used that as an example).

Is this just part of selinux's own security that the tag it assigns a file is unreadable? Or is there something else going on here?

As requested, I ran some additional commands, this time on ".bashrc":

# attr -l .bashrc 
Attribute "selinux" has a 37 byte value for .bashrc

# ls -Z .bashrc 
unconfined_u:object_r:user_home_t:s0 .bashrc

# echo "unconfined_u:object_r:user_home_t:s0"|wc -c
37

So I guess "unconfined_u:object_r:user_home_t:s0" is the value, it's just odd "attr -g selinux" doesn't give it.

0

Are you using an XFS filesystem? It isn't the default on Fedora; did you explicitly arrange that during the installation?

If not, that is probably the reason. The command attr is for XFS filesystems. Check the manual page for details.

What exactly is it you want to do? If you want to see the SELinux context for a file, use ls -Z. If you want to assign your own user attributes, use the commands getfattr and setfattr.

  • I did encrypt the filesystem but didn't otherwise make any changes: I even accepted the default partitioning. I think ext4 (and maybe even ext3 and ext2) support extended file system attributes, and I can use extended attributes on my old Fedora Core 11 default installation. – barrycarter Nov 18 '16 at 22:58
  • Yes, several file systems support extended attributes. But the attr command is only designed for the XFS variant. – Göran Uddeborg Nov 18 '16 at 23:02
  • attr seems to work on Fedora 24 default system, and comes "pre-installed". See also my edits to my original question. – barrycarter Nov 18 '16 at 23:03
  • It works somewhat, in that it finds an attribute and knows its length. But it can not read it, so it isn't working correctly. The attribute name is actually namespaced, it is security.selinux. That too seems to get out wrong when using attr on a non-XFS filesystem. Read man 1 attr and man 5 attr for more information. – Göran Uddeborg Nov 18 '16 at 23:10
  • OK, but getfattr -d . yields nothing at all. I suspect there's some confusion between attr vs getfattr and setfattr, but all three are included by default in a Fedora 24 installation. – barrycarter Nov 18 '16 at 23:17
0

As others have pointed out it is partially a namespace issue. the selinux is in the security namespace. So: sudo attr -S -g selinux . should get you the value. It seems that the attr -l path is listing the security as well as the user namespace attributes, but not letting on about the difference.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.