Re: Application_domain

[Daniel J Walsh <dwalsh@redhat.com>]

Christopher J. PeBenito wrote:
> On Thu, 2007-08-02 at 11:35 -0400, Daniel J Walsh wrote:
>   
>> My definition of the application domain, is any file that a normal
>> user is expected to execute.   It can either have a  transition or
>> not.  If I define application_domain then it will transition.  If I
>> just define application_executable_file, then logged in users can
>> execute it without a transition.
>>
>> Daemons for the most part should NOT be application_domains.   This
>> way we can dontaudit getattr of daemons that users would/should not be
>> allowed to execute.
>>
>> Some applictions can be in both domains.  For example cvs, rsync can
>> be run without transitioning by users but when run from an initscript
>> they transition.
>>
>> This patch makes changes to the pool to match this.
>>     
>
> If you look back at what you're changing, init_system_domains() are all
> apps, so the call is in that interface.  Your patch undoes this.
>
>   
Ok I guess your right, even though some of these being user executables 
is a little shaky.

Reverting patch in rawhide.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.