launching apps at level (MLS) and polyinstantiation

[Ted X Toth <txtoth@gmail.com>]

I'm working on an application that launches other applications at a 
specified level. I have also configured polyinstantiation for a some 
directories. What I have found is that I had to make this application 
pam aware in order for the child process to get polyinstantiated 
directories. One issue is the reauthentication I've already 
authenticated why should I have to reauthenticate so that a child 
process can use polyinstantiated directories? Currently this app works 
when run as root but not as other users because the unshare call in 
pam_namespace fails for lack of permissions (CAP_SYS_ADMIN?). What do I 
need to do so that the application has this capability? I tried making 
the app setuid but that didn't help.

Ted

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.