Re: Impersonating a process for file creation purposes

[Daniel J Walsh <dwalsh@redhat.com>]

On 04/16/2015 05:28 AM, Florian Weimer wrote:
> The ABRT coredump handler has code to emulate default core file creation
> (as if no such pipe-based handler was installed).  The handler runs in a
> separate process, initially as root.  Currently, the handler just
> switches effective IDs and creates the file.  This does not replicate
> the SELinux context of the zombie process.
>
> Is there a way to do that?   Is there some recommended way to inherit
> all the security-related process attributes?
>
You have two choices.  1 would be to setcon() call to change the label
to the user process.

The other choice would be to ask the kernel what label this user would
create if he created a file
in the specified directory.  This is what systemd does.