# SELinux: invalid context in file_contexts.homedirs

## Mark Silinio

after installing selinux all ok, except this thing every emerge:

# emerge ....

...

>>> Setting SELinux security labels

/etc/selinux/targeted/contexts/files/file_contexts.homedirs:  line 20 has invalid context user_u:object_r:user_tmp_t

/etc/selinux/targeted/contexts/files/file_contexts.homedirs:  line 30 has invalid context root:object_r:user_tmp_t

 * 

 * ERROR: ./. failed.

kernel  2.6.23-hardened-r1

selinux-base-policy-20070928

sys-libs/libsepol-1.16.6

sys-libs/libselinux-1.34.13

sys-libs/libsemanage-1.10.5

sys-apps/policycoreutils-1.34.11

sys-apps/checkpolicy-1.34.3

----------

## daten

I get the same messages when running rlpkg to label the filesystem intially.

```
# sudo /usr/sbin/rlpkg -a -r

Relabeling filesystem types: ext2 ext3 jfs xfs

/etc/selinux/targeted/contexts/files/file_contexts.homedirs:  line 20 has invalid context user_u:object_r:user_tmp_t

/etc/selinux/targeted/contexts/files/file_contexts.homedirs:  line 30 has invalid context root:object_r:user_tmp_t

Scanning for shared libraries with text relocations...

Not relabeling /opt/thunderbird/extensions/talkback@mozilla.org/components/libqfaservices.so because it is unlabeled_t.

Not relabeling /opt/firefox/extensions/talkback@mozilla.org/components/libqfaservices.so because it is unlabeled_t.

2 libraries with text relocations, 2 not relabeled.

Some files were not relabeled!  This is not necessarily bad,

but may indicate a labeling problem, since what is detected as

a library is not already labeled with a library type.

If you just relabeled the entire filesystem, please report

this in the #gentoo-hardened IRC channel, the

gentoo-hardened mail list, or Gentoo bugzilla.

Scanning for PIE binaries with text relocations...

0 binaries with text relocations detected.

```

----------

## daten

I commented out the lines in question and ran the command again:

```
$ sudo /usr/sbin/rlpkg -a -r

Relabeling filesystem types: ext2 ext3 jfs xfs

/usr/sbin/setfiles:  labeling files under /

matchpathcon_filespec_add:  conflicting specifications for /usr/lib64/misc/glibc/getconf/POSIX_V6_LP64_OFF64 and /usr/bin/getconf, using system_u:object_r:lib_t.

matchpathcon_filespec_eval:  hash table stats: 379062 elements, 27146/65536 buckets used, longest chain length 45

/usr/sbin/setfiles:  Done.

Scanning for shared libraries with text relocations...

...

```

After checking /etc with ls -lZ it looks like it worked this time.

----------

## daten

This problem returns.  I can't emerge net-fs/nfs-utils-1.1.2-r1.  This time editing the file doesn't help because it keeps reverting.

```
>>> Completed installing nfs-utils-1.1.2-r1 into /var/tmp/portage/net-fs/nfs-utils-1.1.2-r1/image/

ecompressdir: bzip2 -9 /usr/share/man

strip: x86_64-pc-linux-gnu-strip --strip-unneeded -R .comment

   usr/sbin/nfsstat

   usr/sbin/sm-notify

   usr/sbin/rpcdebug

   usr/sbin/showmount

   usr/sbin/rpc.mountd

   usr/sbin/rpc.idmapd

   usr/sbin/exportfs

   usr/sbin/rpc.nfsd

   sbin/mount.nfs

   sbin/rpc.statd

* checking 60 files for package collisions

>>> Merging net-fs/nfs-utils-1.1.2-r1 to /

 * >>> SetUID: [chmod go-r] /sbin/mount.nfs ...                                                                                                                  [ ok ]

>>> Setting SELinux security labels

/etc/selinux/targeted/contexts/files/file_contexts.homedirs:  line 20 has invalid context user_u:object_r:user_tmp_t

/etc/selinux/targeted/contexts/files/file_contexts.homedirs:  line 30 has invalid context root:object_r:user_tmp_t

 * 

 * ERROR: net-fs/nfs-utils-1.1.2-r1 failed.

 * Call stack:

 *       misc-functions.sh, line 618:  Called preinst_selinux_labels

 *       misc-functions.sh, line 524:  Called die

 * The specific snippet of code:

 *            ) || die "Failed to set SELinux security labels."

 *  The die message:

 *   Failed to set SELinux security labels.

 * 

 * If you need support, post the topmost build error, and the call stack if relevant.

 * The ebuild environment file is located at '/var/tmp/portage/net-fs/nfs-utils-1.1.2-r1/temp/environment'.

 * 

!!! post preinst failed; exiting.

!!! FAILED preinst: 1

```

----------

## rjtupas

Daten,

Edit  "/etc/selinux/targeted/contexts/files/homedir_template" just like you edited "file_contexts.homedirs" by commenting out the offending lines (20 and 30).  That should prevent the file from reverting.

Good luck,

Randy

----------

## minimike

 *rjtupas wrote:*   

> Daten,
> 
> Edit  "/etc/selinux/targeted/contexts/files/homedir_template" just like you edited "file_contexts.homedirs" by commenting out the offending lines (20 and 30).  That should prevent the file from reverting.
> 
> Good luck,
> ...

 

That is working here too. But it is an bad hack. Normally emerge should work out of the Box

kind regards Darko Hojnik

----------

## cord

Bug #233992

----------

## muhsinzubeir

probably you have targeted on this file -- >/etc/selinux/config

I use strict, but i can generate those errors if i have targeted..strict works out of the box

cheers

----------

