/selinux/ directory created in root

[Mathew Cairns]

Following a fresh install from kubuntu-9.04-beta-desktop-i386.iso, I noticed that an empty directory /selinux/ has been created in the root directory. The directory is owned by root, with permissions 755, and appears to belong to the libselinux1 package. The presence of additional directories in the root file system seems contrary to the Filesystem Hierarchy Standard.

The problem is also exists in the Kubuntu 9.04 Beta live-usb environment.

I am attaching the output from '$ dpkg -L libselinux1'

ProblemType: Bug
Architecture: i386
Dependencies:
 libgcc1 1:4.3.3-5ubuntu4
 gcc-4.3-base 4.3.3-5ubuntu4
 findutils 4.4.0-2ubuntu3
 libc6 2.9-4ubuntu4
DistroRelease: Ubuntu 9.04
NonfreeKernelModules: nvidia
Package: libselinux1 2.0.65-5build1
ProcEnviron:
 SHELL=/bin/bash
 LANG=en_NZ.UTF-8
 LANGUAGE=
SourcePackage: libselinux
Uname: Linux 2.6.28-11-generic i686

[Mathew Cairns (mat-cairns)]

From my understanding, SELinux uses /selinux/ as a mount point for a selinuxfs filesystem describing the current SELinux policy. AppArmor uses a similar setup, with /sys/kernel/security/ used as a mount point for the active AppArmor security policy.

A more appropriate mount point for the selinuxfs filesystem may be /sys/kernel/selinux/, with a symlink '/selinux/ -> /sys/kernel/selinux/' provided if needed.

[Kees Cook (kees)]

AIUI, SELinux requires this to be /selinux, but it should be moved from libselinux1 to the selinux package, so that it only exists for SELinux users (instead of _everyone_).