State what fields are used when generating SELinux labels from a
baselabel.
---
Notes:
Version 2:
- add reference to example
docs/formatdomain.html.in | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in
index 4e9665f..80caac0 100644
--- a/docs/formatdomain.html.in
+++ b/docs/formatdomain.html.in
@@ -4596,8 +4596,16 @@ qemu-kvm -net nic,model=? /dev/null
</dd>
<dt><code>baselabel</code></dt>
<dd>If dynamic labelling is used, this can optionally be
- used to specify the base security label. The format
- of the content depends on the security driver in use.
+ used to specify the base security label that will be used to generate
+ the actual label. The format of the content depends on the security
+ driver in use.
+
+ The SELinux driver uses only the <code>type</code> field of the
+ baselabel in the generated label. Other fields are inherited from
+ the parent process when using SELinux baselabels.
+
+ (The example above demonstrates the use of <code>my_svirt_t</code>
+ as the value for the <code>type</code> field.)
</dd>
<dt><code>imagelabel</code></dt>
<dd>This is an output only element, which shows the
--
1.8.2.1
--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list