Re: Livecd-creator is disabling selinux

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/13/2014 11:49 AM, Richard W.M. Jones wrote:
> On Mon, Jan 13, 2014 at 10:20:22AM -0500, Daniel J Walsh wrote:
>> Secondly we prevent even unconfined_t from putting down labels on the
>> file system that the kernel does not understand.  IE If I am building a
>> F21 image on a RHEL6 box, it would blow up in enforcing mode if run as
>> unconfined_t.  We added a special policy called livecd_t that is allowed
>> to put down labels which the kernel does not understand, and unconfined_t
>> will transition to this domain.
> 
> Slightly off-topic, but this (in-)ability to label files with labels which
> the kernel doesn't know about affects libguestfs negatively too. Is there
> some reason why it's bad?
> 
> Rich.
> 
Well we could add a label to libguestfs to allow these labels.  From the
running kernel point of view you end up with unlabeled_t.  We also would like
to prevent users from making mistakes like assigning httpd_t to a file when it
is a process type.

SELinux is going to check before you put the label down unless you have the
mac_admin capability.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlLURvoACgkQrlYvE4MpobM8UwCgumLZBVrnwCwwby6jjeKiCXMV
q4QAn3R1avfBzgLHG24DPLEYHSmhAgNE
=YckJ
-----END PGP SIGNATURE-----
-- 
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/devel
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct





[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux