-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 01/13/2014 11:49 AM, Richard W.M. Jones wrote: > On Mon, Jan 13, 2014 at 10:20:22AM -0500, Daniel J Walsh wrote: >> Secondly we prevent even unconfined_t from putting down labels on the >> file system that the kernel does not understand. IE If I am building a >> F21 image on a RHEL6 box, it would blow up in enforcing mode if run as >> unconfined_t. We added a special policy called livecd_t that is allowed >> to put down labels which the kernel does not understand, and unconfined_t >> will transition to this domain. > > Slightly off-topic, but this (in-)ability to label files with labels which > the kernel doesn't know about affects libguestfs negatively too. Is there > some reason why it's bad? > > Rich. > Well we could add a label to libguestfs to allow these labels. From the running kernel point of view you end up with unlabeled_t. We also would like to prevent users from making mistakes like assigning httpd_t to a file when it is a process type. SELinux is going to check before you put the label down unless you have the mac_admin capability. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlLURvoACgkQrlYvE4MpobM8UwCgumLZBVrnwCwwby6jjeKiCXMV q4QAn3R1avfBzgLHG24DPLEYHSmhAgNE =YckJ -----END PGP SIGNATURE----- -- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
