Re: [debian] postfix chroot setup from /etc/init.d/postfix isn't working.

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Wed, Jun 09, 2004 at 10:22:21PM -0400, Ed Street wrote:
> Well why ANY app needs write access to /etc is beyond me.  Also are you
> using run_init /etc/init.d/foo ?
 
 yes, i am, and that's part of the problem.

 if you do an ls --context /var/spool/postfix/etc and compare the files
 listed there to ls --context /etc for example (there are others)
 you will find that the contexts are identical.

 therefore, in order for the chroot jail files to be copyable 
 (and overwritable!) from /etc to /var/spool/postfix/etc,
 and from /lib to /var/spool/postfix/lib, it is necessary to
 give initrd_t (which is what run_init drops you into, yes)
 write permission to etc_t (amongst other things).

 if you do that, you get a policy violation (build error) on a
 "make policy" on one of the checks that bans you from doing
 things like give initrd_t access to writing in etc_t or
 etc_runtime_t.

 l.


-- 
-- 
Information I post is with honesty, integrity, and the expectation that
you will take full responsibility for acting on the information contained,
and that, should you find it to be flawed or even mildly useful, you
will act with both honesty and integrity in return - and tell me.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.