Neal Becker wrote: > Well as to how the file had the wrong context, after re-installing F35 > on the new SSD, I copied the /etc/openvpn directory from my borg > backup of the old one. On the old machine I was running with selinux > disabled, so maybe it was wrong there also. > > /etc/openvpn/client/nbecker8.conf is a hand-edited file. When first > created with e.g., emacs, is there a mechanism to ensure it got the > correct context?
There is. SELinux policy defines the defaults for paths. The `semanage fcontext --list` command will output all of them (this is from an f34 host, in case it differs): $ sudo semanage fcontext --list | grep /etc/openvpn /etc/openvpn(/.*)? all files system_u:object_r:openvpn_etc_t:s0 /etc/openvpn/ipp\.txt regular file system_u:object_r:openvpn_etc_rw_t:s0 /etc/openvpn/scripts(/.*)? all files system_u:object_r:openvpn_unconfined_script_exec_t:s0 If I create a file in the openvpn client directory, it gets the desired labeling: $ sudo ls -Z /etc/openvpn/client/ $ sudo touch /etc/openvpn/client/test $ sudo ls -Z /etc/openvpn/client/test unconfined_u:object_r:openvpn_etc_t:s0 test If I create a file elsewhere and move or copy into the location, it's label is not changed (I'd need to use restorecon or another tool to change it): $ touch /tmp/test $ sudo mv /tmp/test /etc/openvpn/client/ $ sudo ls -Z /etc/openvpn/client/test unconfined_u:object_r:user_tmp_t:s0 test In the process of debugging this, did you perhaps recreate the file? Editing it could potentially do that, if your editor overwrites the existing file on save -- vim does not do that and I don't know that emacs would differ, but I didn't test with emacs. It's fixed now, so that's just a curiosity. But obviously, many of us here are very curious by nature. :) -- Todd
signature.asc
Description: PGP signature
_______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
