60

Chapter 5. Controlling and Maintaining SELinux

 rw rw r  

auser

auser

system_u:object_r:user_home_t

4.html

 rw rw r  

auser

auser

system_u:object_r:user_home_t

5.html

 rw rw r  

auser

auser

system_u:object_r:user_home_t

\

index.html

5.1.4. Make Backups or Archives That Retain Security Contexts

The

tar

utility does not yet support archiving and restoring extended attributes in Red Hat Enterprise

Linux 4. Instead, you can do this using the

star

utility, with the appropriate options

 xattr

and

 H=exustar

. This ensures that extra attributes are captured and the header for the

*.star

file is of

a type that fully supports xattrs:

# Note how the two directories have different labels.

# The ellipses '...' cover the unimportant part of the

# file context for printing purposes:

ls  Z public_html/ web_files/

public_html/:

 rw rw r  

auser

auser

...httpd_user_content_t 1.html

 rw rw r  

auser

auser

...httpd_user_content_t 2.html

 rw rw r  

auser

auser

...httpd_user_content_t 3.html

 rw rw r  

auser

auser

...httpd_user_content_t 4.html

 rw rw r  

auser

auser

...httpd_user_content_t 5.html

 rw rw r  

auser

auser

...httpd_user_content_t index.html

web_files/:

 rw rw r  

auser

auser

user_u:object_r:user_home_t

1.html

 rw rw r  

auser

auser

user_u:object_r:user_home_t

2.html

 rw rw r  

auser

auser

user_u:object_r:user_home_t

3.html

 rw rw r  

auser

auser

user_u:object_r:user_home_t

4.html

 rw rw r  

auser

auser

user_u:object_r:user_home_t

5.html

 rw rw r  

auser

auser

user_u:object_r:user_home_t

index.html

star  xattr  H=exustar  c  f all_web.star public_html/ web_files/

star: 11 blocks + 0 bytes (total of 112640 bytes = 110.00k).

ls  Z all_web.star

 rw rw r  

auser

auser

user_u:object_r:user_home_t \

all_web.star

cp all_web.star /tmp/

cd /tmp/

# Here in /tmp, if there is no specific policy to make a derivative

# temporary type, the default behavior is to acquire the tmp_t type

# for new files, such as the newly copied file all_web.star,

ls  Z all_web.star

 rw rw r  

auser

auser

user_u:object_r:tmp_t

all_web.star

# *.star files are usable by tar, but tar does not know how to

# extract extended attributes.

Without a label on the file,

# the creation of new files in /tmp again chooses the default file

# type of tmp_t:

tar  xvf all_web.star

...

ls  Z /tmp/public_html/ /tmp/web_files/

/tmp/public_html/:

 rw rw r  

auser

auser

user_u:object_r:tmp_t

1.html

 rw rw r  

auser

auser

user_u:object_r:tmp_t

2.html