From: "Christopher J. PeBenito" <cpebenito@tresys.com>
To: Stephen Smalley <sds@tycho.nsa.gov>,
Dominick Grift <dominick.grift@gmail.com>,
dE <de.techno@gmail.com>
Cc: selinux@tycho.nsa.gov
Subject: Re: Significance of SELinux user and roles on objects.
Date: Tue, 27 May 2014 08:36:48 -0400 [thread overview]
Message-ID: <538486E0.4030506@tresys.com> (raw)
In-Reply-To: <537F5039.5070806@tycho.nsa.gov>
On 05/23/2014 09:42 AM, Stephen Smalley wrote:
> On 05/22/2014 03:32 AM, Dominick Grift wrote:
>> On Thu, 2014-05-22 at 12:25 +0530, dE wrote:
>>> On 05/20/14 19:12, Christopher J. PeBenito wrote:
>>>> The kernel will create files with object_r regardless
>>>
>>> Is this defined in the policy or is hard coded in the kernel?
>>
>> Hard coded into the kernel
>
> Unless the policy specifies to default from source or target for the
> file class...
So if I explicitly put default_role from target it will start inheriting the directory's role? If so, did that change also fix role_transition to work on file creation? i.e. can I write a rule like:
role_transition user_r tmp_t:file user_r;
So I can get the default_role from source-like behavior on certain types (I'd like to bring back role separations in refpolicy)?
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
next prev parent reply other threads:[~2014-05-27 12:36 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-05-20 5:01 Significance of SELinux user and roles on objects dE
2014-05-20 13:42 ` Christopher J. PeBenito
2014-05-22 6:55 ` dE
2014-05-22 7:32 ` Dominick Grift
2014-05-23 5:01 ` dE
2014-05-23 13:42 ` Stephen Smalley
2014-05-23 15:45 ` dE
2014-05-23 15:55 ` Stephen Smalley
2014-05-24 3:39 ` dE
2014-05-27 12:36 ` Christopher J. PeBenito [this message]
2014-05-27 12:51 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=538486E0.4030506@tresys.com \
--to=cpebenito@tresys.com \
--cc=de.techno@gmail.com \
--cc=dominick.grift@gmail.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.