Re: learning about policies/transitions

[Serge Hallyn <serge.hallyn@gmail.com>]

Ah, running setfilecon worked.

I don't understand why, though.  The security.selinux xattr (as given by 
getxattr(2)) looked the same before and after.  What else is being changed
by setfilecon?

Thanks!
-serge

> Your policy looks sufficient for that purpose, although there are some
> oddities in it (e.g. you shouldn't be authorizing system_r for object
> types, you should be using object_r in file contexts, a file descriptor
> is not labeled with a file type).  A possible explanation would be an
> inconsistency between the on-disk xattr and the incore inode SID, e.g.
> type wasn't defined at the time that the inode was attached to a
> dentry.  Try setfilecon system_u:object_r:login_et /bin/login and then
> re-trying.  setfiles and chcon tend to not bother setting the context if
> it already appears to be correct, but they only can see the on-disk
> xattr via the xattr API, not the incore inode context.
> 
> --
> Stephen Smalley <sds@epoch.ncsc.mil>
> National Security Agency
> 
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.