From: Daniel J Walsh <dwalsh@redhat.com>
To: SELinux <selinux@tycho.nsa.gov>
Subject: On Fedora 24 I am seeing something strange with CIL
Date: Tue, 29 Mar 2016 10:53:09 -0400 [thread overview]
Message-ID: <56FA96D5.4010806@redhat.com> (raw)
When I compile and install this policy
---------------------------------------------------------------
# cat /tmp/container.te
policy_module(container, 1.0)
virt_sandbox_domain_template(container)
----------------------------------------------------------------
I end up with mknod capability.
sesearch -A -s container_t -t container_t -c capability
Found 1 semantic av rules:
allow container_t container_t : capability mknod ;
But I didn't add mknod to the policy.
grep mknod tmp/container.tmp
class capability { chown dac_override dac_read_search fowner fsetid
kill setgid setuid setpcap linux_immutable net_bind_service
net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio
sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource
sys_time sys_tty_config mknod lease audit_write audit_control setfcap };
Any ideas?
next reply other threads:[~2016-03-29 14:53 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-29 14:53 Daniel J Walsh [this message]
2016-03-29 18:00 ` On Fedora 24 I am seeing something strange with CIL Daniel J Walsh
2016-04-04 19:15 ` Dominick Grift
2016-04-04 19:46 ` Daniel J Walsh
2016-04-04 19:51 ` Dominick Grift
2016-04-04 20:32 ` Steve Lawrence
2016-04-04 20:44 ` Steve Lawrence
2016-04-04 21:26 ` Daniel J Walsh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56FA96D5.4010806@redhat.com \
--to=dwalsh@redhat.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.