rpms/util-linux
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fc6/rhel5 fixes

Browse Source
This commit is contained in:
kzak 2006-08-21 16:24:02 +00:00
parent 3c367f2f3c
commit bc3ff95282
4 changed files with 118 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

126
util-linux-2.13-mount-context.patch
View File

@ -1,63 +1,10 @@
This patch adds to the mount man page docs about context, fscontext and This patch adds to the mount man page docs about context, fscontext and
defcontext mount options and translate context options from human to raw defcontext mount options and translate context options from human to raw
selinux context format. -- 03/30/2006 Karel Zak <kzak@redhat.com> selinux context format. -- 03/30/2006 Karel Zak <kzak@redhat.com>
--- util-linux-2.13-pre7/mount/mount.8.cxt 2006-03-30 17:15:06.000000000 +0200 --- util-linux-2.13-pre6/mount/mount.c.kzak 2006-08-21 11:51:50.000000000 +0200
+++ util-linux-2.13-pre7/mount/mount.8 2006-03-30 17:15:06.000000000 +0200 +++ util-linux-2.13-pre6/mount/mount.c 2006-08-21 11:51:50.000000000 +0200
@@ -661,6 +661,50 @@
.BR noexec ", " nosuid ", and " nodev
(unless overridden by subsequent options, as in the option line
.BR users,exec,dev,suid ).
+.TP
+\fBcontext=\fP\fIcontext\fP, \fBfscontext=\fP\fIcontext\fP and \fBdefcontext=\fP\fIcontext\fP
+The
+.BR context=
+option is useful when mounting filesystems that do not support
+extended attributes, such as a floppy or hard disk formatted with VFAT, or
+systems that are not normally running under SELinux, such as an ext3 formatted
+disk from a non-SELinux workstation. You can also use
+.BR context=
+on filesystems you do not trust, such as a floppy. It also helps in compatibility with
+xattr-supporting filesystems on earlier 2.4.<x> kernel versions. Even where
+xattrs are supported, you can save time not having to label every file by
+assigning the entire disk one security context.
+
+A commonly used option for removable media is
+.BR context=system_u:object_r:removable_t .
+
+Two other options are
+.BR fscontext=
+and
+.BR defcontext= ,
+both of which are mutually exclusive of the context option. This means you
+can use fscontext and defcontext with each other, but neither can be used with
+context.
+
+The
+.BR fscontext=
+option works for all filesystems, regardless of their xattr
+support. The fscontext option sets the overarching filesystem label to a
+specific security context. This filesystem label is separate from the
+individual labels on the files. It represents the entire filesystem for
+certain kinds of permission checks, such as during mount or file creation.
+Individual file labels are still obtained from the xattrs on the files
+themselves. The context option actually sets the aggregate context that
+fscontext provides, in addition to supplying the same label for individual
+files.
+
+You can set the default security context for unlabeled files using
+.BR defcontext=
+option. This overrides the value set for unlabeled files in the policy and requires a
+file system that supports xattr labeling.
+
+For more details see
+.BR selinux (8)
.RE
.TP
.B \-\-bind
--- util-linux-2.13-pre7/mount/mount.c.cxt 2006-03-30 17:15:06.000000000 +0200
+++ util-linux-2.13-pre7/mount/mount.c 2006-03-30 20:16:57.000000000 +0200
@@ -21,6 +21,11 @@ @@ -21,6 +21,11 @@
#include <sys/wait.h> #include <sys/wait.h>
#include <sys/mount.h> #include <sys/mount.h>
@ -151,3 +98,68 @@ selinux context format. -- 03/30/2006 Karel Zak <kzak@redhat.com>
*extra_opts = xmalloc(len); *extra_opts = xmalloc(len);
**extra_opts = '\0'; **extra_opts = '\0';
--- util-linux-2.13-pre6/mount/mount.8.kzak 2006-08-21 11:51:50.000000000 +0200
+++ util-linux-2.13-pre6/mount/mount.8 2006-08-21 11:51:50.000000000 +0200
@@ -660,6 +660,50 @@
.BR noexec ", " nosuid ", and " nodev
(unless overridden by subsequent options, as in the option line
.BR users,exec,dev,suid ).
+.TP
+\fBcontext=\fP\fIcontext\fP, \fBfscontext=\fP\fIcontext\fP and \fBdefcontext=\fP\fIcontext\fP
+The
+.BR context=
+option is useful when mounting filesystems that do not support
+extended attributes, such as a floppy or hard disk formatted with VFAT, or
+systems that are not normally running under SELinux, such as an ext3 formatted
+disk from a non-SELinux workstation. You can also use
+.BR context=
+on filesystems you do not trust, such as a floppy. It also helps in compatibility with
+xattr-supporting filesystems on earlier 2.4.<x> kernel versions. Even where
+xattrs are supported, you can save time not having to label every file by
+assigning the entire disk one security context.
+
+A commonly used option for removable media is
+.BR context=system_u:object_r:removable_t .
+
+Two other options are
+.BR fscontext=
+and
+.BR defcontext= ,
+both of which are mutually exclusive of the context option. This means you
+can use fscontext and defcontext with each other, but neither can be used with
+context.
+
+The
+.BR fscontext=
+option works for all filesystems, regardless of their xattr
+support. The fscontext option sets the overarching filesystem label to a
+specific security context. This filesystem label is separate from the
+individual labels on the files. It represents the entire filesystem for
+certain kinds of permission checks, such as during mount or file creation.
+Individual file labels are still obtained from the xattrs on the files
+themselves. The context option actually sets the aggregate context that
+fscontext provides, in addition to supplying the same label for individual
+files.
+
+You can set the default security context for unlabeled files using
+.BR defcontext=
+option. This overrides the value set for unlabeled files in the policy and requires a
+file system that supports xattr labeling.
+
+For more details see
+.BR selinux (8)
.RE
.TP
.B \-\-bind
--- util-linux-2.13-pre6/mount/Makefile.am.kzak 2006-08-21 12:13:10.000000000 +0200
+++ util-linux-2.13-pre6/mount/Makefile.am 2006-08-21 12:13:03.000000000 +0200
@@ -37,6 +37,9 @@
man_MANS += pivot_root.8
endif
+if HAVE_SELINUX
+mount_LDADD += -lselinux
+endif
swapon.c: swapargs.h

14
util-linux-login.pamd Normal file
View File

@ -0,0 +1,14 @@
#%PAM-1.0
auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session include system-auth
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open
session optional pam_keyinit.so force revoke

14
util-linux-remote.pamd Normal file
View File

@ -0,0 +1,14 @@
#%PAM-1.0
auth required pam_securetty.so
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session include system-auth
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open
session optional pam_keyinit.so force revoke

28
util-linux.spec
View File

@ -9,7 +9,7 @@
Summary: A collection of basic system utilities. Summary: A collection of basic system utilities.
Name: util-linux Name: util-linux
Version: 2.13 Version: 2.13
Release: 0.39 Release: 0.40
License: distributable License: distributable
Group: System Environment/Base Group: System Environment/Base
@ -47,8 +47,9 @@ BuildRequires: zlib-devel
### Sources ### Sources
# TODO [stable]: s/2.13-pre6/%{version}/ # TODO [stable]: s/2.13-pre6/%{version}/
Source0: ftp://ftp.win.tue.nl/pub/linux-local/utils/util-linux/util-linux-2.13-pre6.tar.bz2 Source0: ftp://ftp.win.tue.nl/pub/linux-local/utils/util-linux/util-linux-2.13-pre6.tar.bz2
Source1: util-linux-selinux.pamd Source1: util-linux-login.pamd
Source2: util-linux-chsh-chfn.pamd Source2: util-linux-remote.pamd
Source3: util-linux-chsh-chfn.pamd
Source8: nologin.c Source8: nologin.c
Source9: nologin.8 Source9: nologin.8
Source11: http://download.sourceforge.net/floppyutil/floppy-%{floppyver}.tar.gz Source11: http://download.sourceforge.net/floppyutil/floppy-%{floppyver}.tar.gz
@ -441,9 +442,9 @@ gzip -9nf ${RPM_BUILD_ROOT}%{_infodir}/ipc.info
{ {
pushd ${RPM_BUILD_ROOT}%{_sysconfdir}/pam.d pushd ${RPM_BUILD_ROOT}%{_sysconfdir}/pam.d
install -m 644 %{SOURCE1} ./login install -m 644 %{SOURCE1} ./login
install -m 644 %{SOURCE1} ./remote install -m 644 %{SOURCE2} ./remote
install -m 644 %{SOURCE2} ./chsh install -m 644 %{SOURCE3} ./chsh
install -m 644 %{SOURCE2} ./chfn install -m 644 %{SOURCE3} ./chfn
popd popd
} }
@ -502,6 +503,13 @@ for I in addpart delpart partx; do
fi fi
done done
# /usr/bin -> /bin
for I in taskset; do
if [ -e $RPM_BUILD_ROOT/usr/bin/$I ]; then
mv $RPM_BUILD_ROOT/usr/bin/$I $RPM_BUILD_ROOT/bin/$I
fi
done
# omit info/dir file # omit info/dir file
rm -f ${RPM_BUILD_ROOT}%{_infodir}/dir rm -f ${RPM_BUILD_ROOT}%{_infodir}/dir
@ -545,6 +553,7 @@ exit 0
%attr(755,root,root) /bin/login %attr(755,root,root) /bin/login
/bin/more /bin/more
/bin/kill /bin/kill
/bin/taskset
%config %{_sysconfdir}/pam.d/chfn %config %{_sysconfdir}/pam.d/chfn
%config %{_sysconfdir}/pam.d/chsh %config %{_sysconfdir}/pam.d/chsh
@ -580,7 +589,6 @@ exit 0
%{_bindir}/chrt %{_bindir}/chrt
%{_bindir}/ionice %{_bindir}/ionice
%{_bindir}/taskset
%{_bindir}/cal %{_bindir}/cal
%attr(4711,root,root) %{_bindir}/chfn %attr(4711,root,root) %{_bindir}/chfn
@ -722,6 +730,12 @@ exit 0
/sbin/losetup /sbin/losetup
%changelog %changelog
* Mon Aug 21 2006 Karel Zak <kzak@redhat.com> 2.13-0.40
- fix Makefile.am in util-linux-2.13-mount-context.patch
- fix #201343 - pam_securetty requires known user to work
(split PAM login configuration to two files)
- fix #203358 - change location of taskset binary to allow for early affinity work
* Fri Aug 11 2006 Karel Zak <kzak@redhat.com> 2.13-0.39 * Fri Aug 11 2006 Karel Zak <kzak@redhat.com> 2.13-0.39
- fix #199745 - non-existant simpleinit(8) mentioned in ctrlaltdel(8) - fix #199745 - non-existant simpleinit(8) mentioned in ctrlaltdel(8)