Re: Latest policycoreutils patch

[Joshua Brindle <jbrindle@tresys.com>]

Daniel J Walsh wrote:
> Joshua Brindle wrote:
> 
>> Daniel J Walsh wrote:
>>
>>> Includes Ivan and Russells changes
>>>
>>> Now checks to make sure run as root.
>>
>>
>> while it's probably true that most 'direct' libsemanage sessions need 
>> root that is not necessarily true for policy server so I don't think 
>> there should be a hard coded root check in semanage (aren't we trying 
>> to rely on MAC here anyway?)
> 
> The checks are for genhomedircon and semanage both of which will be 
> prevented from running because of DAC control.
>

why not correctly handle the permission failure instead of hardcoding a 
root check? semanage going through the policy server will not be 
affected by DAC(uid) aside from the permissions on the sock file.

>>>
>>> Also chcat can now manipulate categories of users as well as files.
>>>
> 
> 


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.