problems using setcon()

[Kodungallur Varma <ramgwu@gmail.com>]

Hi all,

   I am trying to dynamically change the context of my program by
using the setcon() function. I have a simple program that tries to do
that but the setcon() function always returns -1 for the input in the
program.

#include <stdio.h>
#include <selinux/selinux.h>

int main()
{
       int i;
       char str[100];
       strcpy(str,"system_u:object_r:libselinux_test_t");
       i = setcon((security_context_t) str);
       if(i == 0)
       {
               printf("changed to new context..\n");
       }
       else if(i == -1)
       {
               printf("error..setcon() returned -1\n");
       }
       else
       {
               printf("unknown result\n");
       }
       return 1;
}

libselinux_test_t is the domain in which I want this program to run. I
have the following policy for that:

-----------
     daemon_domain(libselinux_test_t)

     type libselinux_test_t, domain, privlog;
     role user_r types libselinux_test_t;

     type libselinux_test_dir_t, file_type, sysadmfile;
     type libselinux_test_exec_t, file_type, sysadmfile, exec_type;

    domain_auto_trans(user_t, libselinux_test_exec_t, libselinux_test_t)

    allow libselinux_test_t sshd_t:fd use;
------------

as I am in user_t domain when I execute the program, the program
starts in the user_t domain. but as there is that domain_auto_trans()
into the libselinux_test_t domain, setcon() into that domain soulldnt
fail for the invalid domain reasons.

I dont have any avc: denied messages as the setcon fails. my belief is
that I am passing bad arguements to setcon().

could someone please point out where the problem is. also I tried to
print out the domain of the current process using getcon(), but I have
some problem. could someone let me know how to print that out, rather
that viewing it using ps axZ.

thanx a lot in advance..

Ram


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.