#634081 /usr/sbin/slap* hard links break SELinux

Package:
slapd
Source:
openldap
Description:
OpenLDAP server (slapd)
Submitter:
Daniel Franke
Date:
2011-07-16 17:03:04 UTC
Severity:
normal
#634081#5
Date:
2011-07-16 16:58:47 UTC
From:
To:
The files /usr/sbin/slap* are all hard links to the same binary. The
standard SELinux policy wants the context of /usr/sbin/slapd to be
system_u:object_r:slapd_exec_t, while the rest should be
system_u:object_r:bin_t. The use of hard links makes this impossible,
since SELinux security labels are assigned to inodes.

Ironically, it appears that the reason these files are being created
as hard links is that the original behavior of using symlinks was
breaking AppArmor. See Debian bug #488409 and Ubuntu bug #203898.