Information about execute_no_trans permission

Information about execute_no_trans permission

[Carlos Anísio Monteiro]

Helo.

I would like know how work the *execute_no_trans permission*.
Is it transition ?
How I would interprete this avc message, for sample.

avc:  denied  { execute_no_trans } for  pid=1873 
exe=/usr/sbin/boserver-apache
path=/bin/bash dev=hda3 ino=94777 scontext=system_u:system_r:httpd_t
tcontext=system_u:object_r:shell_exec_t tclass=file

Thanks.

-- 
Carlos Anisio Monteiro  <monteiro@ipen.br>
IPEN/CNEN-SP
Sao Paulo - Brasil


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Information about execute_no_trans permission

[Russell Coker]

On Thu, 19 Aug 2004 00:01, Carlos Anísio Monteiro <monteiro@ipen.br> wrote:
> I would like know how work the *execute_no_trans permission*.
> Is it transition ?
> How I would interprete this avc message, for sample.
>
> avc:  denied  { execute_no_trans } for  pid=1873
> exe=/usr/sbin/boserver-apache
> path=/bin/bash dev=hda3 ino=94777 scontext=system_u:system_r:httpd_t
> tcontext=system_u:object_r:shell_exec_t tclass=file

boserver-apache (domain httpd_t) is trying to execute /bin/bash (type 
shell_exec_t).  There is no rule specifying an automatic domain transition so 
therefore this is a request to execute without transition (execute_no_trans).

If you want to allow this then use the policy:

can_exec(httpd_t, shell_exec_t)

If you want it to run in a different domain then do something like the 
following:

domain_auto_trans(httpd_t, shell_exec_t, target_domain)

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.