what do selinux can't apply partial context to unlabeled file /usr/local/nagios/sbin/

parthipan · 06-07-2012, 02:17 AM

Instead of disabling SELinux or setting it to permissive mode, you can use the following command to run the CGIs under SELinux enforcing/targeted mode:

[root@localhost ~]# chcon -R -t httpd_sys_content_t /usr/local/nagios/sbin/

chcon: can't apply partial context to unlabeled file /usr/local/nagios/sbin/

how to solve this problem?

when i provide

Code:

[root@localhost ~]# getenforce
Disabled
[root@localhost ~]# setenforce 0
setenforce: SELinux is disabled

i tried in many ways

Code:

[root@localhost ~]# cd /usr/local/nagios/sbin
[root@localhost sbin]# ls -Z
-rwxrwxr-x  nagios nagios                                  avail.cgi
-rwxrwxr-x  nagios nagios                                  cmd.cgi
-rwxrwxr-x  nagios nagios                                  config.cgi
-rwxrwxr-x  nagios nagios                                  extinfo.cgi
-rwxrwxr-x  nagios nagios                                  histogram.cgi
-rwxrwxr-x  nagios nagios                                  history.cgi
-rwxrwxr-x  nagios nagios                                  notifications.cgi
-rwxrwxr-x  nagios nagios                                  outages.cgi
-rwxrwxr-x  nagios nagios                                  showlog.cgi
-rwxrwxr-x  nagios nagios                                  status.cgi
-rwxrwxr-x  nagios nagios                                  statusmap.cgi
-rwxrwxr-x  nagios nagios                                  statuswml.cgi
-rwxrwxr-x  nagios nagios                                  statuswrl.cgi
-rwxrwxr-x  nagios nagios                                  summary.cgi
-rwxrwxr-x  nagios nagios                                  tac.cgi
-rwxrwxr-x  nagios nagios                                  trends.cgi
[root@localhost sbin]# chcon -t httpd_sys_script_exec_t *.cgi
chcon: can't apply partial context to unlabeled file avail.cgi
chcon: can't apply partial context to unlabeled file cmd.cgi
chcon: can't apply partial context to unlabeled file config.cgi
chcon: can't apply partial context to unlabeled file extinfo.cgi
chcon: can't apply partial context to unlabeled file histogram.cgi
chcon: can't apply partial context to unlabeled file history.cgi
chcon: can't apply partial context to unlabeled file notifications.cgi
chcon: can't apply partial context to unlabeled file outages.cgi
chcon: can't apply partial context to unlabeled file showlog.cgi
chcon: can't apply partial context to unlabeled file status.cgi
chcon: can't apply partial context to unlabeled file statusmap.cgi
chcon: can't apply partial context to unlabeled file statuswml.cgi
chcon: can't apply partial context to unlabeled file statuswrl.cgi
chcon: can't apply partial context to unlabeled file summary.cgi
chcon: can't apply partial context to unlabeled file tac.cgi
chcon: can't apply partial context to unlabeled file trends.cgi
[root@localhost sbin]# ls -Z
-rwxrwxr-x  nagios nagios                                  avail.cgi
-rwxrwxr-x  nagios nagios                                  cmd.cgi
-rwxrwxr-x  nagios nagios                                  config.cgi
-rwxrwxr-x  nagios nagios                                  extinfo.cgi
-rwxrwxr-x  nagios nagios                                  histogram.cgi
-rwxrwxr-x  nagios nagios                                  history.cgi
-rwxrwxr-x  nagios nagios                                  notifications.cgi
-rwxrwxr-x  nagios nagios                                  outages.cgi
-rwxrwxr-x  nagios nagios                                  showlog.cgi
-rwxrwxr-x  nagios nagios                                  status.cgi
-rwxrwxr-x  nagios nagios                                  statusmap.cgi
-rwxrwxr-x  nagios nagios                                  statuswml.cgi
-rwxrwxr-x  nagios nagios                                  statuswrl.cgi
-rwxrwxr-x  nagios nagios                                  summary.cgi
-rwxrwxr-x  nagios nagios                                  tac.cgi
-rwxrwxr-x  nagios nagios                                  trends.cgi
[root@localhost sbin]# 
[root@localhost sbin]# 
[root@localhost sbin]# 
[root@localhost sbin]# chcon -t httpd_sys_script_exec_t *.cgi
chcon: can't apply partial context to unlabeled file avail.cgi
chcon: can't apply partial context to unlabeled file cmd.cgi
chcon: can't apply partial context to unlabeled file config.cgi
chcon: can't apply partial context to unlabeled file extinfo.cgi
chcon: can't apply partial context to unlabeled file histogram.cgi
chcon: can't apply partial context to unlabeled file history.cgi
chcon: can't apply partial context to unlabeled file notifications.cgi
chcon: can't apply partial context to unlabeled file outages.cgi
chcon: can't apply partial context to unlabeled file showlog.cgi
chcon: can't apply partial context to unlabeled file status.cgi
chcon: can't apply partial context to unlabeled file statusmap.cgi
chcon: can't apply partial context to unlabeled file statuswml.cgi
chcon: can't apply partial context to unlabeled file statuswrl.cgi
chcon: can't apply partial context to unlabeled file summary.cgi
chcon: can't apply partial context to unlabeled file tac.cgi
chcon: can't apply partial context to unlabeled file trends.cgi
[root@localhost sbin]#

kbp · 06-07-2012, 02:32 AM

Try editing /etc/sysconfig/selinux and changing it to 'permissive', then

Code:

touch /.autorelabel
reboot

Once rebooted you probably want to add the file context using

Code:

semanage fcontext -a -t httpd_sys_content_t /usr/local/nagios/sbin

then

Code:

restorecon -r /usr/local/nagios/sbin

unSpawn · 06-07-2012, 03:39 AM

A partial context can't be set if a file is unlabeled. So without setting SELinux to permissive, without autorelabeling and without first setting a fcontext, I would first run 'restorecon -FRvvn /usr/local/nagios/sbin/' to make it show what it would set the context to. (It'll probably default to system_u:object_r:usr_t.) If that's the case then you should be able to 'chcon -u system_u -r object_r -t usr_t -R /usr/local/nagios' and 'chcon -u system_u -r object_r -t httpd_sys_script_exec_t /usr/local/nagios/sbin/*.cgi' before storing changes with 'semanage'. Also note that you shouldn't 'semanage fcontext' "httpd_sys_content_t" on /usr/local/nagios/sbin if the directory contains more than only CGI files and to apply to a context to CGI files alone IIRC the right invocation would be
'semanage fcontext -a -f -- -t httpd_sys_content_t /usr/local/nagios/sbin/.*\.cgi'. Running 'semanage fcontext -l |grep 'local/nagios/sbin';' afterwards should show if it stuck.

ericson007 · 06-07-2012, 07:15 AM

You are getting the error probably because you have disabled SElinux. So all labels are removed. This is shown by your ls command as well since there is not a period after the permissions. (e.g. rwxrwxrwx.) Since the files do not have labels, how can you add a label. You will have to enable selinux and then relable all files (auto way is to reboot) note this may take a while. After it is re enabled, you should be able to set the labels again.

Moderator note: merged from OP's duplicate thread.