* MLS and default file contexts
@ 2007-12-18 16:16 Ted X Toth
2007-12-18 16:36 ` Stephen Smalley
0 siblings, 1 reply; 2+ messages in thread
From: Ted X Toth @ 2007-12-18 16:16 UTC (permalink / raw)
To: SE Linux
As best I can tell the current implementation requires a context to have
a level or range to be valid in an fc file. However there a cases where
I'd prefer that files be created with a given context but at the level
of the creating process. Is there a way to do specify this behavior in
an fc file?
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: MLS and default file contexts
2007-12-18 16:16 MLS and default file contexts Ted X Toth
@ 2007-12-18 16:36 ` Stephen Smalley
0 siblings, 0 replies; 2+ messages in thread
From: Stephen Smalley @ 2007-12-18 16:36 UTC (permalink / raw)
To: Ted X Toth; +Cc: SE Linux, Daniel J Walsh
On Tue, 2007-12-18 at 10:16 -0600, Ted X Toth wrote:
> As best I can tell the current implementation requires a context to have
> a level or range to be valid in an fc file. However there a cases where
> I'd prefer that files be created with a given context but at the level
> of the creating process. Is there a way to do specify this behavior in
> an fc file?
The fc files are just to provide install-time defaults for file labels.
Runtime creation of files is governed by policy; in the case of MLS,
this is inherit-from-creator unless a range transition rule is
specified.
So the only real issue is exempting runtime files from a relabel, which
can be done by specifying a <<none>> entry in a fc file, or putting a
"customizable file context" on the file, or excluding that tree from
relabels.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-12-18 16:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-12-18 16:16 MLS and default file contexts Ted X Toth
2007-12-18 16:36 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.