Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 159946 - New SELinux Targeted policy changes type for /var/log
Summary: New SELinux Targeted policy changes type for /var/log
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: selinux-policy-targeted
Version: 4.0
Hardware: i386
OS: Linux
Target Milestone: ---
: ---
Assignee: Daniel Walsh
QA Contact:
Depends On:
TreeView+ depends on / blocked
Reported: 2005-06-09 15:54 UTC by Peter Snoblin
Modified: 2007-11-30 22:07 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2005-06-09 18:14:33 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Peter Snoblin 2005-06-09 15:54:30 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Description of problem:
The latest update to selinux-policy-targeted changed the type specified for /var/log from var_log_t to home_root_t. These changes occured in /etc/selinux/targeted/src/policy/file_contexts/file_contexts.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Upgrade to selinux-policy-targeted-1.17.30-2.88
2. Run restorecon -R /var/log

Actual Results:  The type of /var/log was set to home_root_t.

Expected Results:  The type of /var/log should have been var_log_t.

Additional info:

This doesn't seem to be a problem for the policies set forth in the selinux-policy-targeted package, however it was an issue as we use a custom policy to govern snort.

Comment 1 Peter Snoblin 2005-06-09 16:08:30 UTC
I just pushed the update to another box, with a nearly identical configuration.
The odd thing here is that this issue did not arise on this second system. The
changes in question were nowhere to be found, and the labeling on /var/log
remained as it should. Yet, on the first machine, this was not an issue until
the upgrade. I'm not sure what's going on here...

Comment 2 Daniel Walsh 2005-06-09 17:55:01 UTC
Do you have a entry in /etc/passwd with an homedir in /var/log?


Comment 3 Peter Snoblin 2005-06-09 18:05:24 UTC
One, the 'snort' user has a homedir at '/var/log/snort' -- however this user
exists on both systems, and the sole difference between the two is the uid.

Comment 4 Daniel Walsh 2005-06-09 18:10:40 UTC
If the snort UID is > 500 and has a shell of something other than /sbin/nologin
or /bin/false  This could happen.  Change the UID or the shell and reload
policy, should clear it up.


Comment 5 Peter Snoblin 2005-06-09 18:14:33 UTC
Ahh, that makes a lot sense!
Thanks for the help, and sorry about bugging you with something so silly.

Note You need to log in before you can comment on or make changes to this bug.