Re: security_bounded_transition fails

[Dominick Grift <dac.override@gmail.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Fri, Dec 18, 2015 at 06:12:21AM +0000, Hannu Savolainen wrote:
> Hi,
> 
> I'm having a problem with a multithreaded application. It does lengthy  initialization in advance under relatively privileged context and then switches to a less privileged one after the moment when the actual request arrives. After that it will create a chrooted container and join all threads to a new SELinux context.
> 
> However the transition fails with audit message "op=security_bounded_transition result=denied oldcontext=old_context newcontext=new_context".
> 
> Is there any policy rule that could be used to fix this or is this just not supported?

I believe that the parent domain should have the same permissions as the child
domain (because the child is bounded to the parent).

This can be pretty painful to deal with.

For example: if the child domain should be able to bind tcp_socket to
http_port_t type port objects then so should the parent.

That one would be relatively easy to identify. There are other
instances though that are harder to spot.

Eventually, once you dealt with all the requirements, those bounded
messages should dissapear.

> 
> Best regards,
> 
> Hannu
> 
> 
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.

- -- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
https://sks-keyservers.net/pks/lookup?op=get&search=0x314883A202DFF788
Dominick Grift
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQGcBAEBCgAGBQJWc8fHAAoJENAR6kfG5xmcNIYL/0QwzDxZvDbwNZTSVK/9mtYx
ODf2f2YON6DED/3hrX1bFvC/5Gho3j5Wobp/Muh25kRRPP+49JN0FmtePIClWNVE
4Jp971AMwHF2XvYjwH4876rXIyjEfj0s2yA4f3ULB1XbPKg3go8Pwj1EHeb0k9qw
uXEODV1a/5IFoDZ2p76rieQCpdSgu0L8tWr2YOJWb8iKY1hG7FPjwLqxRma8jNrv
7vX9q+Vmb1b+06jX2ooqJ1z4tB8LruqWImxqIGUCcNvqKCAIhDyByqLprVZfA7S7
9Hvrqed1xxXSpv5Lq84ycm85Ny2S60vvaJz32lqe7nEQPC/ep2O40j3/USqqSPpS
8sVwRNAWowE2OCJ7ePRPig6kFuH5nN4/Xvb9yZr3/o26eIhqMhFEmN5dzBywSSan
YLsgOWj8FNoterdFGZaiE8r+wKGXZ3ua5zwqlOX/BOIHOKkLnUSwQcDdUgUTipEn
r8keY7+tjOIEIQftNon3rVvzCeQcTaJfheZj0mEQOA==
=m57I
-----END PGP SIGNATURE-----