Where is fixfiles.cron?

[Daniel J Walsh]

Yuichi Nakamura wrote:

>We found that in FedoraCore3 fixfiles.cron is removed after yum update.
>It seems that there is no fixfiles.cron in the latest policycoreutils.
>Why is it removed?
>
>I think fixfiles.cron is necessary to maintain security.
>
>---
>Yuichi Nakamura
>Japan SELinux Users Group(JSELUG)
>　　http://www.selinux.gr.jp/
>
>--
>fedora-selinux-list mailing list
>fedora-selinux-list at redhat.com
>http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  
>
fixfiles.cron causes more problems than it solves. It made little sense
in targeted policy.
It also informed users of problems when there were none and it some
cases would open up security
holes.

Consider if a user wants to make a copy of his gpg keys, he makes a copy
maintaining the security context, next time fixfiles.cron runs it will
tell the administrator that he has mislabeled files and he might blindly
relabel them, removing the save security context.

The other example was if users are labeling directories to be run by
apache using the full power of httpd_TYPE_script_rw_t and others, the
fixfiles will report these as errors. So until someone comes up
with a better way to handle these situations I thought it better to not
install it any longer.

Dan