Hello,
On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/...
As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib.
The first patch of this pull request is needed to make the file contexts in mount.fc more consistent.
I used a script to verify that the file contexts of the /usr/bin... and /usr/sbin... patterns are the same. The script found a single conflict in two contrib modules:
Hello, On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/...
As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib.
This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
The first patch of this pull request is needed to make the file contexts in mount.fc more consistent.
I used a script to verify that the file contexts of the /usr/bin... and /usr/sbin... patterns are the same. The script found a single conflict in two contrib modules:
/usr/bin/imapd -- gen_context(system_u:object_r:courier_pop_exec_t,s0)/usr/sbin/imapd -- gen_context(system_u:object_r:imapd_exec_t,s0)I do not know how to solve this issue.