From: Miroslav Grepl <mgrepl@redhat.com>
To: Divya Vyas <dvyas@mvista.com>, selinux <selinux@tycho.nsa.gov>
Subject: Re: http process running as initrc_t
Date: Fri, 18 Sep 2015 15:31:49 +0200 [thread overview]
Message-ID: <55FC1245.6040408@redhat.com> (raw)
In-Reply-To: <CA+=dQ-95Sob03WHZzjvJiiYS3RnaqB+1O2iGg7YHW5CpGd0_WA@mail.gmail.com>
On 09/16/2015 10:31 PM, Divya Vyas wrote:
> Hi,
>
> run_init /usr/sbin/httpd -k start
>
> leads to
> system_u:system_r:initrc_t:s0 root 3977 1 0 19:57 ?
> 00:00:00 /usr/sbin/httpd -k start
Which is correct. run_init runs a script with a context defined in
/etc/selinux/POLICYTYPE/contexts/initrc_context. So if you run it
directly this way, you get httpd_t running as initrc_t according to
/etc/selinux/POLICYTYPE/contexts/initrc_context.
You should run it using a service script to make sure all proper
transitions will happen.
>
> It should be httpd_t
>
> sesearch -ACT -t httpd_exec_t has the transition
> type_transition initrc_t httpd_exec_t : process httpd_t;
>
>
>
>
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>
--
Miroslav Grepl
Senior Software Engineer, SELinux Solutions
Red Hat, Inc.
prev parent reply other threads:[~2015-09-18 13:31 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-16 20:31 http process running as initrc_t Divya Vyas
2015-09-18 13:31 ` Miroslav Grepl [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55FC1245.6040408@redhat.com \
--to=mgrepl@redhat.com \
--cc=dvyas@mvista.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.