Re: setexeccon vs. setfscreatecon

[James Antill <james.antill@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1330 bytes --]

On Tue, 2006-08-08 at 17:57 +0200, Jim Meyering wrote:

> What you're saying seems to be at odds with setexeccon.1
> as well as with this demonstration (using 2.6.17-1.2462.fc6):
> 
>     $ id -Z
>     user_u:system_r:unconfined_t
>     $ runcon -r object_r -- ./id -Z
>     user_u:object_r:unconfined_t
> 
> since runcon's call to setexeccon does what the man page says it does
> (set exec context for subsequent execve call) and changes the role from
> system_r to object_r.  Does that mean this behavior is Red Hat/Fedora-
> specific?

 No, what Steven was saying is that the label for execcon will be reset
on exec (after doing it's thing). To see this visually use "secon
--self-exec" instead of id.

% secon
user: user_u
role: system_r
type: unconfined_t
sensitivity:
clearance:
mls-range:
% secon --self-exec
user:
role:
type:
sensitivity:
clearance:
mls-range:
% runcon -r system_r secon
user: user_u
role: system_r
type: unconfined_t
sensitivity:
clearance:
mls-range:
% runcon -r system_r -- secon --self-exec
user:
role:
type:
sensitivity:
clearance:
mls-range:


-- 
James Antill - <james.antill@redhat.com>
setsockopt(fd, IPPROTO_TCP, TCP_CONGESTION, ...);
setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, ...);
setsockopt(fd, SOL_SOCKET,  SO_ATTACH_FILTER, ...);


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]