Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932262Ab3COPYb (ORCPT ); Fri, 15 Mar 2013 11:24:31 -0400 Received: from mail-ve0-f179.google.com ([209.85.128.179]:61289 "EHLO mail-ve0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932119Ab3COPY1 (ORCPT ); Fri, 15 Mar 2013 11:24:27 -0400 MIME-Version: 1.0 In-Reply-To: <514319D4.6050200@tycho.nsa.gov> References: <514319D4.6050200@tycho.nsa.gov> From: Thomas COUDRAY Date: Fri, 15 Mar 2013 16:24:05 +0100 Message-ID: Subject: Re: lgetxattr()/getxattr() return different values on a file labelled with selinux disabled To: Stephen Smalley Cc: jmorris@namei.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Paris Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1213 Lines: 35 2013/3/15 Stephen Smalley : > f is truly a regular file and not a symlink pointing to a regular file? f is a truly regular file. > before_t and after_t are both defined in the policy? Only before_t was defined in the policy. When I define after_t in the policy, both commands return the same label (after_t). But I wouldn't expect this to make a difference in the output of both commands (as the only visible difference is lgetxattr() vs getxattr()) > before_t and after_t are not type aliases of each other? They are not. > What are the credentials (capabilities and SELinux security > context/permissions) of the process running the ls and getfattr commands? It has unconfined_u:unconfined_r:before_t label with before_t type. Same as the file f. The process has full SELinux rights on both command and file. > Any relevant messages from SELinux in dmesg output? No avc warnings in dmesg and audit.log. All looks good. -- Thomas Coudray -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/