Re: SELINUX_ERR using chcon to set a printer to Secret

[Daniel J Walsh <dwalsh@redhat.com>]

Christopher J. PeBenito wrote:
> On Fri, 2006-09-29 at 13:51 -0400, Daniel J Walsh wrote:
>   
>> Christopher J. PeBenito wrote:
>>     
>>> On Thu, 2006-09-28 at 15:33 -0400, Matt Anderson wrote:
>>>   
>>>       
>>>> When I add the policy:
>>>>
>>>> allow secadm_t printer_device_t:chr_file { getattr relabelfrom relabelto };
>>>>
>>>> I'm able to perform the relabel from secadm_r.  This meets my needs wrt
>>>> CUPS, but could one of the policy gurus point what in the policy allows
>>>> secadm_r to do this?
>>>>     
>>>>         
>>> You need MLS upgrade and/or downgrade permissions:
>>>
>>> mls_file_upgrade(secadm_t)
>>> mls_file_downgrade(secadm_t)
>>>
>>>   
>>>       
>> No those rules are already there.  I think the problem is in
>>     
>
> I was specifying what made secadm able to do that, as Matt asked :)
>
>   
>> files_relabel_all_files
>>
>> I believe it needs this patch
>> -       allow $1 { file_type $2 }:blk_file { getattr relabelfrom };
>> -       allow $1 { file_type $2 }:chr_file { getattr relabelfrom };
>> +       allow $1 { file_type $2 }:blk_file { getattr relabelfrom 
>> relabelto };
>> +       allow $1 { file_type $2 }:chr_file { getattr relabelfrom 
>> relabelto };
>>     
>
> I don't agree with this, because there shouldn't be any blk_files and
> chr_files that are file_type.
>
>   

Ok I misread the entire discussion. 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.