selinux/restorecond/restorecond.conf

/etc/services
/etc/resolv.conf
/etc/samba/secrets.tdb
/etc/updatedb.conf
/run/utmp
/var/log/wtmp
/root/*
/root/.ssh/*
Author: Daniel J Walsh Email: dwalsh@redhat.com Subject: Add glob support for restorecond Date: Mon, 08 Sep 2008 15:03:51 -0400 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have added supported for GLOB expressions in restorecond. In order to get nsplugin to work well, you need all of the contents of the homedir labeled correctly. Unfortunately gnome creates directories at a fairly random pace. FCFS. So it is very difficult to get transitions to happen properly. As a tradeoff, we can use restorecond to watch the homedir and relabel the directory when it is created. I know this is a potential race condition. where some of the files created in the directory will still have the wrong context, but I don't know of a better solution. Telling everyone they need to restorcon -R -v ~ is not a great solution. If you are worried about information flow you should never rely on restorecond. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkjFdxcACgkQrlYvE4MpobPtjACg3uyqaHD78FRxdaG5mfitnoB/ lh0AnjvfDC2vmCWisxzWq2qFsZMMu3XK =JiG7 -----END PGP SIGNATURE----- Signed-off-by: Joshua Brindle <method@manicmethod.com> 2008-09-07 22:51:09 +00:00			`/etc/services`
initial import from svn trunk revision 2950 2008-08-19 19:30:36 +00:00			`/etc/resolv.conf`
			`/etc/samba/secrets.tdb`
policycoreutils: restorecond: Add /etc/udpatedb.conf to restorecond.conf vmware is doing some nasty stuff with it Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com> 2013-01-28 19:35:49 +00:00			`/etc/updatedb.conf`
restorecond: use /run instead of /var/run On most distributions, /var/run is a symbolic link to /run so using /var/run or /run lead to the same result. Nevertheless systemd started to warn about using /var/run in a service file, logging entries such as: /usr/lib/systemd/system/restorecond.service:8: PIDFile= references path below legacy directory /var/run/, updating /var/run/restorecond.pid → /run/restorecond.pid; please update the unit file accordingly. Switch to /run in order to follow this advice. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org> 2019-02-26 19:02:07 +00:00			`/run/utmp`
initial import from svn trunk revision 2950 2008-08-19 19:30:36 +00:00			`/var/log/wtmp`
policycoreutils: restorecond: make restorecond dbuss-able Basically this patch makes restorecond a dbus session service that can be run in the users session to watch the creation of files in the homedir. Most of the changes are just to get it to run as a dbus session and then to allow it to read its own config. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Dan Walsh <dwalsh@redhat.com> 2011-08-03 15:40:47 +00:00			`/root/*`
Author: Daniel J Walsh Email: dwalsh@redhat.com Subject: patch to policycoreutils Date: Wed, 01 Apr 2009 10:10:43 -0400 Multiple patches to policycoreutils. First added /root/.ssh and /root/.ssh/* to allow people to place keys in /root directory and have them labeled by restorcond <snipdue to previously ack'd patch> Clean up permissive domains creation in semanage so it does not leave crap in /var/lib/selinux --- Also have fixfiles operate recursively when in RPM mode, per: Author: Daniel J Walsh Email: dwalsh@redhat.com Subject: Re: patch to policycoreutils Date: Wed, 22 Apr 2009 21:50:48 -0400 If a package owned a directory like /var/lib/libvirt/images, when it is relabeling we would want it to relabel not only the directory but the contents of the directory Signed-off-by: Chad Sellers <csellers@tresys.com> 2009-04-10 23:17:47 +00:00			`/root/.ssh/*`