Re: findutils-4.2.15

Russell Coker wrote:

> On Tuesday 01 February 2005 01:48, Tim Waugh <twaugh@xxxxxxxxxx> wrote:
>  
>
> > I just updated findutils to 4.2.15 in devel.  Please check that I
> > didn't make any mistakes porting the findutils-selinux.patch.
> >    
> I can't comment on the changes as I never tested the old version.  Here are 
> some suggestions about the current version:
> getfilecon(/proc/2/maps): Operation not supported
>
> Above is part of the output of "find / --context system_u:object_r:bin_t".  
> Perhaps it would make sense that whenever find enters a new file system it 
> checks whether the context is available and skips file systems of types that 
> don't support the XATTR interface to labelling.  We could have a config file 
> which lists the supported file systems (ext2, ext3, xfs, devpts, and tmpfs at 
> the moment) so that find knows what to do.  Or maybe this is something that 
> should be in the kernel?  Another option might be to just have find give up 
> on a tree when a directory gives ENOTSUP.
> Searching on context alone seems of little utility to me.  I think it's likely 
> that most times when a search is being performed the desired result will 
> either be all files of a particular identity or of a particular type.  For 
> example I may want to find files of type bin_t to discover the full list of 
> programs that can_exec(foo_t, bin_t) grants access to.  The fact that I 
> created some files under /usr/local/bin by just copying them there as 
> administrator (and giving them the context of root:object_r:bin_t instead of 
> the usual system_u:object_r:bin_t) not something that concerns me.
> Also saving some typing is a benefit too.  When running chcon I often use the 
> -t option to save typing as usually I only want to change the type and am not 
> concerned about the identity.
>  
Find has glob support to do something similar
so you can

find / --context *:bin_t

to find all bin_t files.


> The command `find . -printf "%Z %f\n"` returns the string "pipefs" instead of 
> the final "t" in file contexts.  Eg here's part of the output of running such 
> a find command from the /var/run directory:
> system_u:object_r:xdm_var_run_pipefs gdm.pid
>
> Here's "ls -lZ" output from the same file:
> -rw-r--r--  root     root     system_u:object_r:xdm_var_run_t  gdm.pid
>
> Once again, being able to split out identity and type would be handy, the 
> -printf option has a huge number of ways of specifying atime with %A, maybe 
> having %Zi for identity, %Zt for type, and %z for full context would be a 
> good idea.
>