Invalid context in targeted SELinux policy

["Daniel Musgrave" <dmusgrave@abodiosoftware.com>]

I am in the process of writing an application and associated policy in Centos 4.3, running a targeted SELinux environment at version 1.17.30-2.126.  After succesfully creating the necessary rules in my .te file, and the associated file contexts in the .fc file, I am attempting to resolve one last problem.  After compiling my policy and running the application, I get the following error:

audit(...): security_compute_sid: invalid context root:system_r:upgrade_t for scontext=root:system_r:unconfined_t tcontext=system_u:object_r:upgrade_exec_t tclass=process

The domain for this executable is 'upgrade' and the file context of the binary is 'upgrade_exec_t' (there are some associated *_log_t and *_tmp_t files as well).  The .te file defines upgrade using the application_domain macro.

I have thus far been unable to find any sort of documentation or discussion that relates to this specific problem (most file_context issues seem to come from improperly-formatted .fc files during labeling, rather than at runtime).  Am I forgetting to include some line in my .te file?  Do I need to include the new domain/type I've created in some other location?  Any insight you can provide would be greatly appreciated.

Thanks,

Daniel

PS - here is my .fc file, in case my problem somehow *does* involve it.

upgrade.fc
# upgrade
/usr/bin/upgrade      --  system_u:object_r:upgrade_exec_t
/var/log/upgrade.log  --  system_u:object_r:upgrade_log_t
/tmp/upgrade(/.*)?    --  system_u:object_r:upgrade_tmp_t




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.