From: cpebenito@tresys.com (Christopher J. PeBenito)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] MLS file upgrade
Date: Thu, 2 Feb 2012 10:23:13 -0500 [thread overview]
Message-ID: <4F2AAA61.3090304@tresys.com> (raw)
In-Reply-To: <4F29E259.60205@nps.edu>
On 02/01/12 20:09, Paul Clark wrote:
> I want to change the MLS policy to allow any process to upgrade a file or directory, but I'm currently failing on an "easy" first step with a "relabelfrom" error.
>
> I'm using Fedora 13 and selinux-policy-3.7.19-101.fc13.src.rpm.
>
> I did *not* change the mlscontrain rule that deals with relabelfrom because I think it should still work.
>
> My test file has the same type that chcon runs with (user_t), and I'm simply trying to change the level from s0 to s1 by doing the following:
> chcon -l s1 testfile
Can you clarify this? It sounds like you're saying that your file is labeled user_t. If thats the case, then its a regular TE problem, as user_t isn't a file type, so you can't relabel it.
> I changed the mlsvalidatetrans statement for "dir" and "file" so that the first line was changed from
> ((( l1 eq l2 ) or
> to
> ((( l1 domby l2 ) or
>
> Any obvious problems or suggestions?
>
> Another approach would be to also give all domains the "mlsfileupgrade" attribute. Because my test process was running with user_t, I added:
> mls_file_upgrade(user_t)
> to modules/admin/usermanage.te, but there was no change in the error.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
next prev parent reply other threads:[~2012-02-02 15:23 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-02-02 1:09 [refpolicy] MLS file upgrade Paul Clark
2012-02-02 15:23 ` Christopher J. PeBenito [this message]
2012-02-02 18:26 ` Paul Clark
2012-02-03 13:25 ` Christopher J. PeBenito
2012-02-03 22:12 ` Paul Clark
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F2AAA61.3090304@tresys.com \
--to=cpebenito@tresys.com \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.