From c431e8bc4858ab0caa8f7ec0d669a6235c30e694 Mon Sep 17 00:00:00 2001 From: Sergey Khalyutn Date: Fri, 10 Jul 2026 15:33:04 +0300 Subject: [PATCH 1/5] Adjust SELinux context for fbguard --- builds/install/posix-common/posixLibrary.sh.in | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/builds/install/posix-common/posixLibrary.sh.in b/builds/install/posix-common/posixLibrary.sh.in index 1522285b011..32c987c0fe5 100644 --- a/builds/install/posix-common/posixLibrary.sh.in +++ b/builds/install/posix-common/posixLibrary.sh.in @@ -927,6 +927,13 @@ fixFilePermissions() { rm -f $tmp1 $tmp2 $tmp3 $tmp4 + # fb_guard + cd @FB_BINDIR@ + for FileName in fbguard + do + chcon -t bin_t $FileName + done + # Lock files cd @FB_GUARDDIR@ for FileName in fb_guard From 227eeff2d08b69f923664913026db719a4f15227 Mon Sep 17 00:00:00 2001 From: Sergey Khalyutn Date: Thu, 30 Jul 2026 16:54:35 +0300 Subject: [PATCH 2/5] Adjust SELinux context replace 'chcon' to 'semanage' --- .../install/posix-common/posixLibrary.sh.in | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/builds/install/posix-common/posixLibrary.sh.in b/builds/install/posix-common/posixLibrary.sh.in index 32c987c0fe5..2e6238fdd20 100644 --- a/builds/install/posix-common/posixLibrary.sh.in +++ b/builds/install/posix-common/posixLibrary.sh.in @@ -931,7 +931,28 @@ fixFilePermissions() { cd @FB_BINDIR@ for FileName in fbguard do - chcon -t bin_t $FileName + + # check need fcontext + if [[ $(ls -Z / | grep usr | grep system_u:) ]]; then + + # check fcontext for fbguard not bin_t + if [[ ! $(ls -Z \"$FileName\" | grep bin_t) ]]; + + # check semanage exists + if [[ $(command -v semanage) ]]; then + + semanage fcontext --add -t bin_t \"$FileName\"? 2>/dev/null + restorecon -vRF \"$FileName\" 2>/dev/null + + else + + echo "/n $(ls -Z \"$FileName\")" + echo "/nPlease install 'semanage' and 'restorecon' from 'policycoreutils-python(-utils)' and reinstall firebird \n for '$FileName' may be run as service." + + fi + + fi + fi done # Lock files From 5802346e027ac4e95bb0c065834b7c4794ab9324 Mon Sep 17 00:00:00 2001 From: Sergey Khalyutn Date: Thu, 30 Jul 2026 17:03:05 +0300 Subject: [PATCH 3/5] Adjust SELinux context replace 'chcon' to 'semanage' correct --- builds/install/posix-common/posixLibrary.sh.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/builds/install/posix-common/posixLibrary.sh.in b/builds/install/posix-common/posixLibrary.sh.in index 2e6238fdd20..de9b6ff7597 100644 --- a/builds/install/posix-common/posixLibrary.sh.in +++ b/builds/install/posix-common/posixLibrary.sh.in @@ -936,7 +936,7 @@ fixFilePermissions() { if [[ $(ls -Z / | grep usr | grep system_u:) ]]; then # check fcontext for fbguard not bin_t - if [[ ! $(ls -Z \"$FileName\" | grep bin_t) ]]; + if [[ ! $(ls -Z \"$FileName\" | grep bin_t) ]]; then # check semanage exists if [[ $(command -v semanage) ]]; then From 4e738ca22052d9c9fa29bf364e96de086b961f44 Mon Sep 17 00:00:00 2001 From: Sergey Khalyutn Date: Thu, 30 Jul 2026 18:26:23 +0300 Subject: [PATCH 4/5] Adjust SELinux context correct if rule exists --- builds/install/posix-common/posixLibrary.sh.in | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/builds/install/posix-common/posixLibrary.sh.in b/builds/install/posix-common/posixLibrary.sh.in index de9b6ff7597..ec1abb27721 100644 --- a/builds/install/posix-common/posixLibrary.sh.in +++ b/builds/install/posix-common/posixLibrary.sh.in @@ -931,26 +931,26 @@ fixFilePermissions() { cd @FB_BINDIR@ for FileName in fbguard do - # check need fcontext if [[ $(ls -Z / | grep usr | grep system_u:) ]]; then # check fcontext for fbguard not bin_t - if [[ ! $(ls -Z \"$FileName\" | grep bin_t) ]]; then - + if [[ ! $(ls -Z ${fb_install_prefix}/bin/$FileName | grep bin_t) ]]; then # check semanage exists - if [[ $(command -v semanage) ]]; then + if [[ $(command -v semanage) ]]; then - semanage fcontext --add -t bin_t \"$FileName\"? 2>/dev/null - restorecon -vRF \"$FileName\" 2>/dev/null + semanage fcontext --delete \"${fb_install_prefix}/bin/$FileName\"? > /dev/null + restorecon -vRF ${fb_install_prefix}/bin/$FileName > /dev/null + + semanage fcontext --add -t bin_t \"${fb_install_prefix}/bin/$FileName\"? > /dev/null + restorecon -vRF ${fb_install_prefix}/bin/$FileName > /dev/null else - echo "/n $(ls -Z \"$FileName\")" - echo "/nPlease install 'semanage' and 'restorecon' from 'policycoreutils-python(-utils)' and reinstall firebird \n for '$FileName' may be run as service." + echo "!!! SELinux context error: $(ls -Z ${fb_install_prefix}/bin/$FileName)" + echo "!!! Please install 'semanage' and 'restorecon' from 'policycoreutils-python(-utils)' and reinstall firebird \n for '$FileName' may be run as service." fi - fi fi done From 65e19a680e7b1b114fee63bf70365c129c1738cf Mon Sep 17 00:00:00 2001 From: Sergey Khalyutn Date: Thu, 30 Jul 2026 19:17:25 +0300 Subject: [PATCH 5/5] Adjust SELinux context replace if [[ ]] to if [ ] --- builds/install/posix-common/posixLibrary.sh.in | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/builds/install/posix-common/posixLibrary.sh.in b/builds/install/posix-common/posixLibrary.sh.in index ec1abb27721..4053ffcaeb6 100644 --- a/builds/install/posix-common/posixLibrary.sh.in +++ b/builds/install/posix-common/posixLibrary.sh.in @@ -932,12 +932,15 @@ fixFilePermissions() { for FileName in fbguard do # check need fcontext - if [[ $(ls -Z / | grep usr | grep system_u:) ]]; then + if [ "$(ls -Z / | grep usr | grep system_u:)" != "" ]; then # check fcontext for fbguard not bin_t - if [[ ! $(ls -Z ${fb_install_prefix}/bin/$FileName | grep bin_t) ]]; then + if [ "$(ls -Z ${fb_install_prefix}/bin/$FileName | grep bin_t)" == "" ]; then + + # echo "before $(ls -Z ${fb_install_prefix}/bin/$FileName)" + # check semanage exists - if [[ $(command -v semanage) ]]; then + if [ "$(command -v semanage)" != "" ]; then semanage fcontext --delete \"${fb_install_prefix}/bin/$FileName\"? > /dev/null restorecon -vRF ${fb_install_prefix}/bin/$FileName > /dev/null @@ -945,10 +948,13 @@ fixFilePermissions() { semanage fcontext --add -t bin_t \"${fb_install_prefix}/bin/$FileName\"? > /dev/null restorecon -vRF ${fb_install_prefix}/bin/$FileName > /dev/null + # echo "after $(ls -Z ${fb_install_prefix}/bin/$FileName)" + else echo "!!! SELinux context error: $(ls -Z ${fb_install_prefix}/bin/$FileName)" - echo "!!! Please install 'semanage' and 'restorecon' from 'policycoreutils-python(-utils)' and reinstall firebird \n for '$FileName' may be run as service." + echo "!!! Please install 'semanage' and 'restorecon' and reinstall firebird" + echo "!!! for '$FileName' may be run as service." fi fi