From: pebenito@ieee.org (Chris PeBenito)
Date: Sat, 13 Aug 2016 08:32:13 -0400
Subject: [refpolicy] [PATCH] fc_sort must be explicitly labeled as
 executable upon creation
In-Reply-To: <1470669970.10405.3.camel@trentalancia.net>
References: <1470669970.10405.3.camel@trentalancia.net>
Message-ID: <d3c37764-e873-3e70-4301-d7e7635b37c7@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 08/08/16 11:26, Guido Trentalancia wrote:
> Force a bin_t label on the fc_sort executable after creating it, to avoid execution
> denials (e.g. misplaced generic default labels).
>
> Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
> ---
>  Makefile |    1 +
>  1 file changed, 1 insertion(+)
>
> --- refpolicy-04062012/Makefile	2012-05-29 21:13:09.413703575 +0200
> +++ refpolicy-04062012-chcon-fc_sort/Makefile	2012-08-04 21:35:57.396092798 +0200
> @@ -400,6 +400,7 @@ $(mod_conf) $(booleans): $(polxml)
>  #
>  $(fcsort) : $(support)/fc_sort.c
>  	$(verbose) $(CC) $(CFLAGS) $^ -o $@
> +	chcon system_u:object_r:bin_t:s0 $(tmpdir)/fc_sort
>
>  ########################################
>  #

I'd prefer not to hard code any labeling into make targets except for 
those that are explicitly for labeling.

-- 
Chris PeBenito