Re: SELINUX_ERR using chcon to set a printer to Secret

[Daniel J Walsh <dwalsh@redhat.com>]

Christopher J. PeBenito wrote:
> On Thu, 2006-09-28 at 15:33 -0400, Matt Anderson wrote:
>   
>> When I add the policy:
>>
>> allow secadm_t printer_device_t:chr_file { getattr relabelfrom relabelto };
>>
>> I'm able to perform the relabel from secadm_r.  This meets my needs wrt
>> CUPS, but could one of the policy gurus point what in the policy allows
>> secadm_r to do this?
>>     
>
> You need MLS upgrade and/or downgrade permissions:
>
> mls_file_upgrade(secadm_t)
> mls_file_downgrade(secadm_t)
>
>   
No those rules are already there.  I think the problem is in

files_relabel_all_files

I believe it needs this patch

diff -u files.if~ files.if
--- files.if~   2006-09-27 17:07:37.000000000 -0400
+++ files.if    2006-09-29 13:48:53.000000000 -0400
@@ -896,8 +896,8 @@
        allow $1 { file_type $2 }:lnk_file { getattr relabelfrom 
relabelto };
        allow $1 { file_type $2 }:fifo_file { getattr relabelfrom 
relabelto };
        allow $1 { file_type $2 }:sock_file { getattr relabelfrom 
relabelto };
-       allow $1 { file_type $2 }:blk_file { getattr relabelfrom };
-       allow $1 { file_type $2 }:chr_file { getattr relabelfrom };
+       allow $1 { file_type $2 }:blk_file { getattr relabelfrom 
relabelto };
+       allow $1 { file_type $2 }:chr_file { getattr relabelfrom 
relabelto };
 
        # satisfy the assertions:
        seutil_relabelto_bin_policy($1)


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.