Path: csiph.com!news.redatomik.org!aioe.org!bofh.it!news.nic.it!robomod From: Ben Hutchings Newsgroups: linux.debian.bugs.dist,linux.debian.kernel Subject: Bug#906729: Please fix SELinux labels of /vmlinuz symlink after kernel update Date: Tue, 21 Aug 2018 02:10:02 +0200 Message-ID: References: X-Original-To: Laurent Bigonville , 906729@bugs.debian.org X-Mailbox-Line: From debian-bugs-dist-request@lists.debian.org Tue Aug 21 00:03:13 2018 Old-Return-Path: X-Spam-Flag: NO X-Spam-Score: -2.299 Reply-To: Ben Hutchings , 906729@bugs.debian.org Resent-To: debian-bugs-dist@lists.debian.org Resent-Cc: Debian Kernel Team X-Debian-Pr-Message: followup 906729 X-Debian-Pr-Package: linux-base X-Debian-Pr-Source: linux-2.6, linux-base X-Spam-Bayes: score:0.0000 Tokens: new, 14; hammy, 150; neutral, 61; spammy, 0. spammytokens: hammytokens:0.000-+--H*c:pgp-sha512, 0.000-+--H*F:D*decadent.org.uk, 0.000-+--H*RU:sk:shadbol, 0.000-+--H*r:sk:shadbol, 0.000-+--HX-SA-Exim-Scanned:sk:shadbol Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-m+2WqNt5Z8LmVd2mbBAD" X-Mailer: Evolution 3.28.5-1 MIME-Version: 1.0 X-Sa-Exim-Connect-IP: 2a02:8011:400e:2:cbab:f00:c93f:614 X-Sa-Exim-Mail-From: ben@decadent.org.uk X-Sa-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false X-Debian-Message: from BTS X-Mailing-List: archive/latest/1480359 List-ID: List-URL: Approved: robomod@news.nic.it Lines: 61 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Date: Tue, 21 Aug 2018 00:59:43 +0100 X-Original-Message-ID: <01084b82ba6f2c0dae31041a9c5db0ec9ff3769d.camel@decadent.org.uk> X-Original-References: <153475781975.8041.4969759210085056376.reportbug@valinor.bigon.be> <153475781975.8041.4969759210085056376.reportbug@valinor.bigon.be> Xref: csiph.com linux.debian.bugs.dist:913814 linux.debian.kernel:61875 --=-m+2WqNt5Z8LmVd2mbBAD Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Control: tag -1 moreinfo On Mon, 2018-08-20 at 11:36 +0200, Laurent Bigonville wrote: > Package: linux-base > Version: 4.5 > Severity: normal > File: /usr/bin/linux-update-symlinks > User: selinux-devel@lists.alioth.debian.org > Usertags: selinux >=20 > Hi, >=20 > After updating the kernel it seems that the /vmlinuz(.old) and > /initrd.img(.old) symlinks are deleted and then recreated. >=20 > This means that the SELinux label of these symlinks should be reset. >=20 > The easiest way of doing that is (as there are no perl bindings) to call > restorecon executable if the executable is installed on the machine as > it handel the case were selinux is disabled on the machine gracefully >=20 > ie. restorecon /vmlinuz Why is this needed? Only boot loaders should be using these symlinks and they don't know or care about SELinux stuff. Ben. --=20 Ben Hutchings For every action, there is an equal and opposite criticism. - Harrison --=-m+2WqNt5Z8LmVd2mbBAD Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAlt7VfAACgkQ57/I7JWG EQlynw//bC6PO1hgRHqgslKLN6XoBkSqs3ZJgHi3kid1XHk1zxLXklA7Xhrcw1zX tkjIyXrWEPugqIi165ZdV8PIowaSdFJ6nnqKpRVEPX/hwKEXusVlSxVTP7DPVpdw 7tqYB8Z8gn+JCAeO6H22n3gaF6dHFdO+4Ro5lpQB5XBEJmOG745adJnvQj3TIFHG HQxs5aShIEgqIQrXRcH9IPyhf4Ud3fii2HjXZzYB+A8zCBipZ+BomxPBmlGddclL 3d7qY3zk4anF1n9L7rQkvkcYkHteiCxyqkahF2kir9M30huruKujevjji4jzuOM/ 48WLfNYdG2ySlqOIHwcWF9BVieoO3fpNu9Zv9Yn/oOe2HkyPAj0WkZB9bwcYJMmp D7KvGaessaKWrik1y5TPcsHGrj0GQ3UotIl3EcX30cZShUacjDAd78TIaj64tpnx 1KuJpFEkbBDQ/5nIS2iK3soakXZSO67YmkEUd1zBb0hl8k58mJpj5HjTfVlBlWx4 6N+V5+wzpiYbgHetPDPPEfr6xJbNCvZyjFO+BgTQ9auKZsbir08c/+ovqip7A2F+ LM8RRUwMLXsXoHLJnL7Uazw0vO2EDCZ5+FThh8zCSgF8E1Hhuzo6f9mEgyiQuxlj OrUzOng4FHDZVzPC+g2PaGS//exT205D1UVFxwfuMjefanLcems= =6Whi -----END PGP SIGNATURE----- --=-m+2WqNt5Z8LmVd2mbBAD--