From: Stephen Smalley <sds@tycho.nsa.gov>
To: kim.lawson-jenkins@nrl.navy.mil, selinux@tycho.nsa.gov
Subject: Re: Labelling problems with a user directly running an application in a confined domain
Date: Tue, 01 Apr 2014 11:12:59 -0400 [thread overview]
Message-ID: <533AD77B.3070107@tycho.nsa.gov> (raw)
In-Reply-To: <026a01cf4db2$9524fb60$bf6ef220$@nrl.navy.mil>
On 04/01/2014 09:59 AM, Kim Lawson-Jenkins wrote:
> Hi,
>
>
>
> I’m pretty sure my questions are basic SELinux 101 but I’m having a
> problem confining an application when a user runs the application
> directly. On our system I have removed the unconfined domain and
> unconfined user. When the system initializes the confined applications
> run in the correct confined domains. However, if I use ssh to access
> the server, stop an application, and then start the application again,
> the application will run with the label sshd_t. I haven’t tried
> starting a confined application from a local console but I’ll probably
> encounter a similar problem. How should I modify the policy to allow a
> confined user to execute an application but also have the application
> run in the application’s confined domain?
If it is running in sshd_t, that suggests a bug in your policy that
prevented sshd from transitioning into a user domain.
When you removed the unconfined domain and user, did you also update
your semanage login and semanage user mappings so that no user is still
being mapped to unconfined_u / unconfined_r?
next prev parent reply other threads:[~2014-04-01 15:12 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-01 13:59 Labelling problems with a user directly running an application in a confined domain Kim Lawson-Jenkins
2014-04-01 15:12 ` Stephen Smalley [this message]
2014-04-01 17:04 ` Kim Lawson-Jenkins
2014-04-01 17:07 ` Stephen Smalley
2014-04-01 17:42 ` Kim Lawson-Jenkins
2014-04-01 17:53 ` Stephen Smalley
2014-04-01 18:08 ` Kim Lawson-Jenkins
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=533AD77B.3070107@tycho.nsa.gov \
--to=sds@tycho.nsa.gov \
--cc=kim.lawson-jenkins@nrl.navy.mil \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.