Re: semodule problem

[Joshua Brindle <jbrindle@tresys.com>]

Rosalie Hiebel wrote:
> I was able to successfully modify, load, and test policy rules (using 
> audit2allow to add rules) until I ran into a problem with one 
> particular rule I tried to add.   After adding this rule
>
>    allow testserver_t self:process { setcurrent };
>
> then semodule gave me the following error:
>
>   libsepol.check_assertion_helper: assertion on line 0 violated by
>             allow testserver_t testserver_t:process{ setcurrent };
>   libsepol.check_assertions: 1 assertion violations occurred
>   libsermanage.semanage_expand_ssandbox:Expand module failed
>
> Any clues what caused this?
>
> Thanks
# enabling setcurrent breaks process tranquility.  If you do not
# know what this means or do not understand the implications of a
# dynamic transition, you should not be using it!!!
neverallow { domain -set_curr_context } self:process setcurrent;

This neverallow doesn't let anything use setcurrent unless it has the 
set_curr_context attribute (assigned using the domain_dyntrans_type 
interface). You typically shouldn't be using setcurrent anyway, is there 
something specific you are trying to do?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.