named pt2

named pt2

[Timothy Wood]

Can someone explain to my why bind works if I let init start it but it
does not start if I start it as root from the cli?

Timothy,




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: named pt2

[Russell Coker]

On Wed, 3 Jul 2002 17:48, Timothy Wood wrote:
> Can someone explain to my why bind works if I let init start it but it
> does not start if I start it as root from the cli?

You are supposed to use run_init to run the init script.  run_init causes the 
script to be run as system_u:system_r:initrc_t, and then a 
domain_auto_trans() rule transitions it to system_u:system_r:named_t which is 
the correct context of the daemon.

Running it in another context denies it access to port 53 (port 53 is only 
for named_t).

-- 
I do not get viruses because I do not use MS software.
If you use Outlook then please do not put my email address in your
address-book so that WHEN you get a virus it won't use my address in the
>From field.


--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: named pt2

[Stephen Smalley]

On 3 Jul 2002, Timothy Wood wrote:

> Can someone explain to my why bind works if I let init start it but it
> does not start if I start it as root from the cli?

When running init scripts directly from an administrator shell, you need
to use run_init so that the init script will run with the right security
context (system_u:system_r:initrc_t) and any daemons will transition to
the correct domain.

--
Stephen D. Smalley, NAI Labs
ssmalley@nai.com




--
You have received this message because you are subscribed to the selinux list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.