Re: [Fwd: Latest Diff]

[Daniel J Walsh <dwalsh@redhat.com>]

Ivan Gyurdiev wrote:

>>Doesn't you patch mean that every app that links with orbit needs to 
>>able to read context files
>>and able to setfscreatecon?
>>
>>    
>>
>
>Oh - I thought you meant something else.
>Yes, it does. Is this a bad thing?
>
>The setfscreatecon is limited to self -
>
>##################################
>#
># can_setfscreate(domain)
>#
># Authorize a domain to set its fscreate context
># (via /proc/pid/attr/fscreate).
>#
>define(`can_setfscreate',`
>allow $1 self:process setfscreate;
>allow $1 proc_t:dir search;
>allow $1 proc_t:{ file lnk_file } read;
>allow $1 self:dir search;
>allow $1 self:file { getattr read write };
>')
>
>Here's the full list of selinux privileges needed:
>
>
># Set its type - libselinux integration
>can_setfscreate($1_t)
>can_getsecurity($1_t)
>r_dir_file($1_t, selinux_config_t)
>r_dir_file($1_t, file_context_t)
>allow $1_t default_context_t:dir search;
>
>  
>
I think I can create a file with context of passwd_t via those privs?

-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.