RepoMirrors/selinux
1
0
Fork 0
mirror of https://github.com/SELinuxProject/selinux synced 2024-12-24 23:12:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
a4149e0eab
selinux/policycoreutils/scripts/fixfiles.8

105 lines
3.0 KiB
Groff
Raw Normal View History

initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.TH "fixfiles" "8" "2002031409" "" ""
.SH "NAME"
fixfiles \- fix file SELinux security contexts.
.SH "SYNOPSIS"
policycoreutils: fixfiles: tidy up usage(), manpage synopsis Make sure usage() in fixfiles shows all the current options. It's printed when there's a user error, so it needs to be helpful! (Excluding the deprecated option - see below). manpage: Remove the deprecated option `-l logfile`. Add missing space in `restore|[-f] relabel`. It's not clear why `-R rpmpackagename` was considered optional in the second invocation. (If the user omits it, they are just performing the first invocation). It desn't match usage() in fixfiles either. Clean up bolding for `fixfiles onboot`. Disable justification (troff "adjustment") in the synopsis. We want the common options in the different invocations to line up consistently. Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-07 11:05:47 +00:00
.na
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
policycoreutils: fixfiles: refactor into the `set -u` dialect This commit allows the use of `set -u` to detect reads of unset variables. But what I really liked was making the code more explicit about these modes. I hope that this is easier for a new reader to reason about. `fixfiles restore` has accumulated five different modes it can run in. Now use a single variable to indicate the mode, out-of-band of the variables used for the individual modes. Apparently `set -u` / `set -o nounset` doesn't work correctly with arrays. If we ever need bash arrays, we can simply remove `set -u`. The `set -u` dialect is a strict subset. See http://mywiki.wooledge.org/BashFAQ/112 Extra notes: RESTORE_MODE was created because I couldn't bring myself to use an empty FILEPATH, as a special case to indicate the default mode. Arguments to the script (paths) could be empty already, so it would mean I had to work out how we behaved in that case and decide whether it was reasonable. It turns out the `-B | -N time` mode is distinct and does not respect paths. So we can tell the user we're not going to do anything with the paths they passed. Make sure this distinction is shown in the usage error message. We already rejected the combination of `-R rpmpackage,... dir/file...`. Being aware of the different modes just causes more bogus combinations to be rejected. Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-07 11:05:52 +00:00
.B fixfiles
fixfiles: correctly restore context of mountpoints By bind mounting every filesystem we want to relabel we can access all files without anything hidden due to active mounts. This comes at the cost of user experience, because setfiles only displays the percentage if no path is given or the path is / Signed-off-by: Jonathan Hettwer <j2468h@gmail.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-08-06 14:48:36 +00:00
.I [\-v] [\-F] [-M] [\-f] relabel
policycoreutils: fixfiles: refactor into the `set -u` dialect This commit allows the use of `set -u` to detect reads of unset variables. But what I really liked was making the code more explicit about these modes. I hope that this is easier for a new reader to reason about. `fixfiles restore` has accumulated five different modes it can run in. Now use a single variable to indicate the mode, out-of-band of the variables used for the individual modes. Apparently `set -u` / `set -o nounset` doesn't work correctly with arrays. If we ever need bash arrays, we can simply remove `set -u`. The `set -u` dialect is a strict subset. See http://mywiki.wooledge.org/BashFAQ/112 Extra notes: RESTORE_MODE was created because I couldn't bring myself to use an empty FILEPATH, as a special case to indicate the default mode. Arguments to the script (paths) could be empty already, so it would mean I had to work out how we behaved in that case and decide whether it was reasonable. It turns out the `-B | -N time` mode is distinct and does not respect paths. So we can tell the user we're not going to do anything with the paths they passed. Make sure this distinction is shown in the usage error message. We already rejected the combination of `-R rpmpackage,... dir/file...`. Being aware of the different modes just causes more bogus combinations to be rejected. Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-07 11:05:52 +00:00
.B fixfiles
policycoreutils: fixfiles: remove bad modes of "relabel" command * `fixfiles -B relabel` or `fixfiles -C previouscontext relabel` would skip the code that handles e.g. `/var/tmp`, which would be run by `fixfiles relabel`. It would still remove all files in /tmp (subject to user confirmation). This is confusing, undocumented, and unlikely to be intentional. * `fixfiles relabel path1 path2` is the same, except it would only relabel the first path. * `fixfiles -R ... relabel` was equivalent to `fixfiles -R ... restore`, again contradicting the man page. Also `fixfiles onboot` would ignore paths, -C, or -R. fixfiles is mostly for users, where it should be acceptable to remove these non-sensical combinations. `fixfiles -C` is used in selinux-policy rpm install scripts. However I believe the rpms used `fixfiles -C previouscontext restore`, and did not either require user interaction or blow away /tmp without prompting. So they should still work fine. With these combinations removed, we can remove the `exit` calls which were seen in some of the (non-error) code paths in `restore()`. Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-07 11:05:54 +00:00
.I [\-v] [\-F] { check | restore | verify } dir/file ...
.B fixfiles
.I [\-v] [\-F] [\-B | \-N time ] { check | restore | verify }
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
This patch removes OUTPUT from fixfiles which was never used and was broken Patches come from Moray.Henderson@ict.om.org Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-03 15:37:13 +00:00
.B fixfiles
policycoreutils: fixfiles: tidy up usage(), manpage synopsis Make sure usage() in fixfiles shows all the current options. It's printed when there's a user error, so it needs to be helpful! (Excluding the deprecated option - see below). manpage: Remove the deprecated option `-l logfile`. Add missing space in `restore|[-f] relabel`. It's not clear why `-R rpmpackagename` was considered optional in the second invocation. (If the user omits it, they are just performing the first invocation). It desn't match usage() in fixfiles either. Clean up bolding for `fixfiles onboot`. Disable justification (troff "adjustment") in the synopsis. We want the common options in the different invocations to line up consistently. Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-07 11:05:47 +00:00
.I [\-v] [\-F] \-R rpmpackagename[,rpmpackagename...] { check | restore | verify }
This patch removes OUTPUT from fixfiles which was never used and was broken Patches come from Moray.Henderson@ict.om.org Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-03 15:37:13 +00:00
policycoreutils: fixfiles: tidy up usage(), manpage synopsis Make sure usage() in fixfiles shows all the current options. It's printed when there's a user error, so it needs to be helpful! (Excluding the deprecated option - see below). manpage: Remove the deprecated option `-l logfile`. Add missing space in `restore|[-f] relabel`. It's not clear why `-R rpmpackagename` was considered optional in the second invocation. (If the user omits it, they are just performing the first invocation). It desn't match usage() in fixfiles either. Clean up bolding for `fixfiles onboot`. Disable justification (troff "adjustment") in the synopsis. We want the common options in the different invocations to line up consistently. Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-07 11:05:47 +00:00
.B fixfiles
.I [\-v] [\-F] \-C PREVIOUS_FILECONTEXT { check | restore | verify }
.B fixfiles
fixfiles: correctly restore context of mountpoints By bind mounting every filesystem we want to relabel we can access all files without anything hidden due to active mounts. This comes at the cost of user experience, because setfiles only displays the percentage if no path is given or the path is / Signed-off-by: Jonathan Hettwer <j2468h@gmail.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-08-06 14:48:36 +00:00
.I [-F] [-M] [-B] onboot
This patch removes OUTPUT from fixfiles which was never used and was broken Patches come from Moray.Henderson@ict.om.org Signed-off-by: Joshua Brindle <method@manicmethod.com>
2009-11-03 15:37:13 +00:00
policycoreutils: fixfiles: tidy up usage(), manpage synopsis Make sure usage() in fixfiles shows all the current options. It's printed when there's a user error, so it needs to be helpful! (Excluding the deprecated option - see below). manpage: Remove the deprecated option `-l logfile`. Add missing space in `restore|[-f] relabel`. It's not clear why `-R rpmpackagename` was considered optional in the second invocation. (If the user omits it, they are just performing the first invocation). It desn't match usage() in fixfiles either. Clean up bolding for `fixfiles onboot`. Disable justification (troff "adjustment") in the synopsis. We want the common options in the different invocations to line up consistently. Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-07 11:05:47 +00:00
.ad
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "DESCRIPTION"
This manual page describes the
.BR fixfiles
script.
.P
This script is primarily used to correct the security context
database (extended attributes) on filesystems.
.P
It can also be run at any time to relabel when adding support for
new policy, or just check whether the file contexts are all
as you expect. By default it will relabel all mounted ext2, ext3, xfs and
jfs file systems as long as they do not have a security context mount
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
2013-10-09 18:37:31 +00:00
option. You can use the \-R flag to use rpmpackages as an alternative.
policycoreutils: fixfiles: introduce /etc/selinux/fixfiles_exclude_dirs Introduce a new file /etc/selinux/fixfiles_exclude_dirs which contains a list of directories which should not be relabeled. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2011-07-10 12:14:14 +00:00
The file /etc/selinux/fixfiles_exclude_dirs can contain a list of directories
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
2013-10-09 18:37:31 +00:00
excluded from relabeling.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.P
.B fixfiles onboot
will setup the machine to relabel on the next reboot.
.SH "OPTIONS"
.TP
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
2013-10-09 18:37:31 +00:00
.B \-B
If specified with onboot, this fixfiles will record the current date in the /.autorelabel file, so that it can be used later to speed up labeling. If used with restore, the restore will only affect files that were modified today.
.TP
.B \-F
Force reset of context to match file_context for customizable files
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.TP
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
2013-10-09 18:37:31 +00:00
.B \-f
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
Clear /tmp directory with out prompt for removal.
.TP
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
2013-10-09 18:37:31 +00:00
.B \-R rpmpackagename[,rpmpackagename...]
policycoreutils: fixfiles: un-document `-R -a` option `fixfiles -R -a` is much less useful than it was made to sound, because -R now works recursively. Therefore `fixfiles -R -a` relabels every file on the system, multiple times. On my system it took over 5 times as long as plain `fixfiles` (which takes about a minute). Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-05-07 11:05:53 +00:00
Use the rpm database to discover all files within the specified packages and restore the file contexts.
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.TP
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
2013-10-09 18:37:31 +00:00
.B \-C PREVIOUS_FILECONTEXT
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
Run a diff on the PREVIOUS_FILECONTEXT file to the currently installed one, and restore the context of all affected files.
policycoreutils: setfiles: estimate percent progress This patch started with work from John Reiser patch to estimate the percent progress for restorecon/setfiles. It has a lot of changes since then, to make it only happen on full relabel, overwrite itself, shows 10ths of %, and does a lot better and more useful job of estimation. We get all of the inodes on all mounted FS. Since the number of inodes is not fixed and only an estimate I added 5% to the inode number, and forced the number to never go over 100. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-02-03 16:56:39 +00:00
.TP
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
2013-10-09 18:37:31 +00:00
.B \-N time
Only act on files created after the specified date. Date must be specified in
Minor manpages improvements
2013-11-06 12:24:01 +00:00
"YYYY\-MM\-DD HH:MM" format. Date field will be passed to find \-\-newermt command.
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
2013-10-09 18:37:31 +00:00
fixfiles: correctly restore context of mountpoints By bind mounting every filesystem we want to relabel we can access all files without anything hidden due to active mounts. This comes at the cost of user experience, because setfiles only displays the percentage if no path is given or the path is / Signed-off-by: Jonathan Hettwer <j2468h@gmail.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-08-06 14:48:36 +00:00
.TP
.B \-M
Bind mount filesystems before relabeling them, this allows fixing the context of files or directories that have been mounted over.
Laurent Bigonville patch to fix various minor manpage issues and correct section numbering.
2013-10-09 18:37:31 +00:00
.TP
policycoreutils: setfiles: estimate percent progress This patch started with work from John Reiser patch to estimate the percent progress for restorecon/setfiles. It has a lot of changes since then, to make it only happen on full relabel, overwrite itself, shows 10ths of %, and does a lot better and more useful job of estimation. We get all of the inodes on all mounted FS. Since the number of inodes is not fixed and only an estimate I added 5% to the inode number, and forced the number to never go over 100. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-02-03 16:56:39 +00:00
.B -v
Minor manpages improvements
2013-11-06 12:24:01 +00:00
Modify verbosity from progress to verbose. (Run restorecon with \-v instead of \-p)
policycoreutils: setfiles: estimate percent progress This patch started with work from John Reiser patch to estimate the percent progress for restorecon/setfiles. It has a lot of changes since then, to make it only happen on full relabel, overwrite itself, shows 10ths of %, and does a lot better and more useful job of estimation. We get all of the inodes on all mounted FS. Since the number of inodes is not fixed and only an estimate I added 5% to the inode number, and forced the number to never go over 100. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com>
2012-02-03 16:56:39 +00:00
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
.SH "ARGUMENTS"
One of:
.TP
.B check
print any incorrect file context labels, showing old and new context, but do not change them.
.TP
.B restore
change any incorrect file context labels.
.TP
.B relabel
Prompt for removal of contents of /tmp directory and then change any incorrect file context labels to match the install file_contexts file.
.TP
.B verify
List out files with incorrect file context labels, but do not change them.
.TP
.B [[dir/file] ... ]
List of files or directories trees that you wish to check file context on.
.SH "AUTHOR"
This man page was written by Richard Hally <rhally@mindspring.com>.
The script was written by Dan Walsh <dwalsh@redhat.com>
.SH "SEE ALSO"
policycoreutils, python: Fix bad manpage formatting in "SEE ALSO" Fix missing and surplus commas. Fix the following formatting errors: .BR selinux(8) renders the the "(8)" in bold as well as the "selinux". This is wrong. .B selinux (8) renders with a space between "selinux" and "(8)", this is wrong. .B selinux (8) commits both of the above mistakes. .BR selinux (8), apparmor (8) omits the space separating "selinux(8)," and "apparmor(8)", this is wrong. Correct all the above using the following markup: .BR selinux (8), .BR apparmor (8) Signed-off-by: Alan Jenkins <alan.christopher.jenkins@gmail.com>
2017-01-11 12:41:09 +00:00
.BR setfiles (8),
.BR restorecon (8)
initial import from svn trunk revision 2950
2008-08-19 19:30:36 +00:00
Reference in New Issue Copy Permalink