|
 |
afc235 |
From c556c6ad0b94cf3ba4b441a1a0930f2468434227 Mon Sep 17 00:00:00 2001
|
|
|
afc235 |
From: Vit Mojzis <vmojzis@redhat.com>
|
|
|
afc235 |
Date: Wed, 10 Feb 2021 18:05:29 +0100
|
|
|
afc235 |
Subject: [PATCH] selinux(8,5): Describe fcontext regular expressions
|
|
|
afc235 |
|
|
|
afc235 |
Describe which type of regular expression is used in file context
|
|
|
afc235 |
definitions and which flags are in effect.
|
|
|
afc235 |
|
|
|
afc235 |
Explain how local file context modifications are processed.
|
|
|
afc235 |
|
|
|
afc235 |
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
|
|
afc235 |
Acked-by: Petr Lautrbach <plautrba@redhat.com>
|
|
|
afc235 |
---
|
|
|
afc235 |
python/semanage/semanage | 2 +-
|
|
|
afc235 |
python/semanage/semanage-fcontext.8 | 18 ++++++++++++++++++
|
|
|
afc235 |
2 files changed, 19 insertions(+), 1 deletion(-)
|
|
|
afc235 |
|
|
|
afc235 |
diff --git a/python/semanage/semanage b/python/semanage/semanage
|
|
|
afc235 |
index 781e8645..ebb93ea5 100644
|
|
|
afc235 |
--- a/python/semanage/semanage
|
|
|
afc235 |
+++ b/python/semanage/semanage
|
|
|
afc235 |
@@ -366,7 +366,7 @@ If you do not specify a file type, the file type will default to "all files".
|
|
|
afc235 |
parser_add_seuser(fcontextParser, "fcontext")
|
|
|
afc235 |
parser_add_type(fcontextParser, "fcontext")
|
|
|
afc235 |
parser_add_range(fcontextParser, "fcontext")
|
|
|
afc235 |
- fcontextParser.add_argument('file_spec', nargs='?', default=None, help=_('file_spec'))
|
|
|
afc235 |
+ fcontextParser.add_argument('file_spec', nargs='?', default=None, help=_('Path to be labeled (may be in the form of a Perl compatible regular expression)'))
|
|
|
afc235 |
fcontextParser.set_defaults(func=handleFcontext)
|
|
|
afc235 |
|
|
|
afc235 |
|
|
|
afc235 |
diff --git a/python/semanage/semanage-fcontext.8 b/python/semanage/semanage-fcontext.8
|
|
|
afc235 |
index 561123af..49635ba7 100644
|
|
|
afc235 |
--- a/python/semanage/semanage-fcontext.8
|
|
|
afc235 |
+++ b/python/semanage/semanage-fcontext.8
|
|
|
afc235 |
@@ -11,6 +11,24 @@ SELinux policy without requiring modification to or recompilation
|
|
|
afc235 |
from policy sources. semanage fcontext is used to manage the default
|
|
|
afc235 |
file system labeling on an SELinux system. This command maps file paths using regular expressions to SELinux labels.
|
|
|
afc235 |
|
|
|
afc235 |
+FILE_SPEC may contain either a fully qualified path,
|
|
|
afc235 |
+or a Perl compatible regular expression (PCRE),
|
|
|
afc235 |
+describing fully qualified path(s). The only PCRE flag in use is PCRE2_DOTALL,
|
|
|
afc235 |
+which causes a wildcard '.' to match anything, including a new line.
|
|
|
afc235 |
+Strings representing paths are processed as bytes (as opposed to Unicode),
|
|
|
afc235 |
+meaning that non-ASCII characters are not matched by a single wildcard.
|
|
|
afc235 |
+
|
|
|
afc235 |
+Note, that file context definitions specified using 'semanage fcontext'
|
|
|
afc235 |
+(i.e. local file context modifications stored in file_contexts.local)
|
|
|
afc235 |
+have higher priority than those specified in policy modules.
|
|
|
afc235 |
+This means that whenever a match for given file path is found in
|
|
|
afc235 |
+file_contexts.local, no other file context definitions are considered.
|
|
|
afc235 |
+Entries in file_contexts.local are processed from most recent one to the oldest,
|
|
|
afc235 |
+with first match being used (as opposed to the most specific match,
|
|
|
afc235 |
+which is used when matching other file context definitions).
|
|
|
afc235 |
+All regular expressions should therefore be as specific as possible,
|
|
|
afc235 |
+to avoid unintentionally impacting other parts of the filesystem.
|
|
|
afc235 |
+
|
|
|
afc235 |
.SH "OPTIONS"
|
|
|
afc235 |
.TP
|
|
|
afc235 |
.I \-h, \-\-help
|
|
|
afc235 |
--
|
|
|
afc235 |
2.29.2
|
|
|
afc235 |
|