Re: problems using setcon()

[Kodungallur Varma <ramgwu@gmail.com>]

Hi Stephen and all,

       the following setconexample.c(attachment) really did help me,
but I have one more issue. I dont have the context_str() function. I
installed the 2.6.11.5 kernel and tried to apply patches mentioned in
the NSA website. I updated to the checkpolicy-1.22, libselinux-1.22,
policycoreutils-1.22, ibsepol-1.4. I dont know if I am supposed to
upgrade to the above.  I wanted to update to apply the patch-2.6.11.6.
but I could not execute it and I dont know how to apply it. I wonder
why I dont have just the context_str().

also, when I make load from the directory
/etc/selinux/strict/src/policy/, I have the following errors:

Validating file_contexts ...
/usr/sbin/setfiles -q -c /etc/selinux/strict/policy/policy.19
/etc/selinux/strict/contexts/files/file_contexts
/usr/sbin/load_policy /etc/selinux/strict/policy/policy.19
sepol_genusers: Can't load system.users:  No such file or directory
/usr/sbin/load_policy:  Error while setting user configuration from
/etc/selinux/strict/users//{local.users,system.users}:  No such file
or directory
/usr/sbin/load_policy:  security_load_policy failed
make: *** [tmp/load] Error 3

why is the above occuring?? 

any help would do a great deal to completion of my thesis. thanx in advance..

Ram


On Mon, 14 Mar 2005 10:06:12 -0500, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On Fri, 2005-03-11 at 21:35 -0500, Kodungallur Varma wrote:
> >        I came to know that I cant simply cast a string into a security
> > identifier as shown below. insted I found out that I have to use
> > security_compute_create().
> 
> No, you can directly construct context strings; you just have to ensure
> that they are valid contexts or the kernel will reject them.  The
> easiest approach is to use getcon() to get the current context, then use
> the context_new(), context_type_set(), context_str() functions to create
> a context string with a modified type field, and then call setcon() on
> the resulting context string.  security_compute_create() is appropriate
> when you want to get a context based on a type_transition rule in the
> policy (for an exec-based process transition or a file creation), but
> that is not what you are doing.  Sample program below should work for
> you, assuming appropriate policy and a kernel that supports dynamic
> context transitions (>= 2.6.11 for the mainline kernel).  Policy would
> need can_setcon() for the domain and allow <olddomain>
> <newdomain>:process dyntransition; (the domain_auto_trans rules are for
> exec-based transitions only).
> 
> --
> Stephen Smalley <sds@tycho.nsa.gov>
> National Security Agency
> 
> 
>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.