Linux sandbox and the -i option

Linux sandbox and the -i option

[Bill]

Is anyone else having issues with the
% sandbox -i [path]
not working?  What happens is the context is incorrectly done.

%ls -Zd /tmp/.sandbox_home_[whatever]
gives
unconfined_u:object_r:sandbox_file_t:s0:cxx,cyyy .
BUT
%ls -Z [path] is
gives
unconfined_u:object_r:mozilla_home_t:s0 [path]

This causes all sorts of read/write issues.

I guess I can write a script to do the
chcon, but that is a bit painful and you have to hunt
for the correct sandbox directory (not optimal at all).

Any suggestions?

-- 
William Chimiak

Re: Linux sandbox and the -i option

[Stephen Smalley]

On 03/01/2016 08:31 AM, Bill wrote:
> Is anyone else having issues with the
> % sandbox -i [path]
> not working?  What happens is the context is incorrectly done.
>
> %ls -Zd /tmp/.sandbox_home_[whatever]
> gives
> unconfined_u:object_r:sandbox_file_t:s0:cxx,cyyy .
> BUT
> %ls -Z [path] is
> gives
> unconfined_u:object_r:mozilla_home_t:s0 [path]
>
> This causes all sorts of read/write issues.
>
> I guess I can write a script to do the
> chcon, but that is a bit painful and you have to hunt
> for the correct sandbox directory (not optimal at all).
>
> Any suggestions?

I think this is really a question for the fedora selinux list and/or a 
redhat bugzilla, but regardless, you need to provide more information 
(e.g. distro version, package version, etc).

Re: Linux sandbox and the -i option

[Miroslav Grepl]

On 03/02/2016 02:53 PM, Stephen Smalley wrote:
> On 03/01/2016 08:31 AM, Bill wrote:
>> Is anyone else having issues with the
>> % sandbox -i [path]
>> not working?  What happens is the context is incorrectly done.
>>
>> %ls -Zd /tmp/.sandbox_home_[whatever]
>> gives
>> unconfined_u:object_r:sandbox_file_t:s0:cxx,cyyy .
>> BUT
>> %ls -Z [path] is
>> gives
>> unconfined_u:object_r:mozilla_home_t:s0 [path]
>>
>> This causes all sorts of read/write issues.
>>
>> I guess I can write a script to do the
>> chcon, but that is a bit painful and you have to hunt
>> for the correct sandbox directory (not optimal at all).
>>
>> Any suggestions?
> 
> I think this is really a question for the fedora selinux list and/or a
> redhat bugzilla, but regardless, you need to provide more information
> (e.g. distro version, package version, etc).

Yes, could you please ask on selinux@lists.fedoraproject.org with
package details?

Thank you.

> 
> 
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to
> Selinux-request@tycho.nsa.gov.


-- 
Miroslav Grepl
Senior Software Engineer, SELinux Solutions
Red Hat, Inc.