Re: [PATCH] doc: Clarify usage of SELinux baselabel

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 04/24/2013 07:30 AM, Peter Krempa wrote:
> State what fields are used when generating SELinux labels from a
> baselabel.
> ---
>  docs/formatdomain.html.in | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
> index 888c005..9118ff0 100644
> --- a/docs/formatdomain.html.in
> +++ b/docs/formatdomain.html.in
> @@ -4596,8 +4596,13 @@ qemu-kvm -net nic,model=? /dev/null
>        </dd>
>        <dt><code>baselabel</code></dt>
>        <dd>If dynamic labelling is used, this can optionally be
> -        used to specify the base security label. The format
> -        of the content depends on the security driver in use.
> +        used to specify the base security label that will be used to generate
> +        the actual label. The format of the content depends on the security
> +        driver in use.
> +
> +        The SELinux driver uses only the <code>type</code> field of the
> +        baselabel in the generated label. Other fields are inherited from
> +        the parent process when using SELinux baselabels.

ACK - definite improvement.

Hmm - we already gave the example of:
    &lt;baselabel&gt;system_u:system_r:my_svirt_t:s0&lt;/baselabel&gt;

Would it help to mention here that in the example above, the baselabel
uses only the 'my_svirt_t' portion of the given label?

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

Attachment: signature.asc
Description: OpenPGP digital signature

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list

[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]