chown affecting type_transition?

chown affecting type_transition?

[Ted Toth]

[-- Attachment #1: Type: text/plain, Size: 434 bytes --]

I'm writing policy for some scripts. Script 'a' runs script 'b' and they
each have their own entry file and domain type. There is a type transition
for a_t through b_exec_t to b_t in the policy. However the transition
doesn't happen. Script 'a' does a chown on script 'b' prior to running it.
If I remove the chown the transition does happen as expected. Can chown
somehow affect the file label? 'ls -Z' doesn't show any change.

Ted

[-- Attachment #2: Type: text/html, Size: 499 bytes --]

Re: chown affecting type_transition?

[Joe Nall]

On Aug 1, 2011, at 10:32 AM, Ted Toth wrote:

> I'm writing policy for some scripts. Script 'a' runs script 'b' and they
> each have their own entry file and domain type. There is a type transition
> for a_t through b_exec_t to b_t in the policy. However the transition
> doesn't happen. Script 'a' does a chown on script 'b' prior to running it.
> If I remove the chown the transition does happen as expected. Can chown
> somehow affect the file label? 'ls -Z' doesn't show any change.

Does the transition occur if b is already chowned? Could you have a DAC issue after the chown?

joe




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: chown affecting type_transition?

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 656 bytes --]



On Mon, 2011-08-01 at 10:32 -0500, Ted Toth wrote:
> I'm writing policy for some scripts. Script 'a' runs script 'b' and they
> each have their own entry file and domain type. There is a type transition
> for a_t through b_exec_t to b_t in the policy. However the transition
> doesn't happen. Script 'a' does a chown on script 'b' prior to running it.
> If I remove the chown the transition does happen as expected. Can chown
> somehow affect the file label? 'ls -Z' doesn't show any change.

only thing i can think of is that the execute bit is not set for the
owner or group you chowned the file to.

In that case a dac issue.
> 
> Ted

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: chown affecting type_transition?

[Ted Toth]

[-- Attachment #1: Type: text/plain, Size: 934 bytes --]

Sorry red herring. There was a su buried in 'b' which was only used if the
chown occurred in 'a' (I didn't write these scripts). Changed su to runuser
and am moving forward again.

Ted

On Mon, Aug 1, 2011 at 3:23 PM, Dominick Grift <domg472@gmail.com> wrote:

>
>
> On Mon, 2011-08-01 at 10:32 -0500, Ted Toth wrote:
> > I'm writing policy for some scripts. Script 'a' runs script 'b' and they
> > each have their own entry file and domain type. There is a type
> transition
> > for a_t through b_exec_t to b_t in the policy. However the transition
> > doesn't happen. Script 'a' does a chown on script 'b' prior to running
> it.
> > If I remove the chown the transition does happen as expected. Can chown
> > somehow affect the file label? 'ls -Z' doesn't show any change.
>
> only thing i can think of is that the execute bit is not set for the
> owner or group you chowned the file to.
>
> In that case a dac issue.
> >
> > Ted
>

[-- Attachment #2: Type: text/html, Size: 1341 bytes --]