On Thu, 2005-01-20 at 10:47 -0500, Daniel J Walsh wrote: > This sounds like a bug. A user executing a httpd script should not be > changing context to httpd_sys_script_t, correct? There's an explicit rule for this now, in macros/program/apache_macros.te: ifelse($1, sys, ` # # If a user starts a script by hand it gets the proper context # domain_auto_trans(sysadm_t, httpd_$1_script_exec_t, httpd_$1_script_t) role sysadm_r types httpd_$1_script_t; ', ` # If a user starts a script by hand it gets the proper context domain_auto_trans($1_t, httpd_$1_script_exec_t, httpd_$1_script_t) role $1_r types httpd_$1_script_t; We probably want to just drop this in targeted policy. In strict, we grant userdomains access to all the derived types such as httpd_sys_content_t, so not doing the transition (i.e. just changing it to can_exec, or maybe domain_trans) should allow the CGI script to continue to work, at first glance. But I have a feeling there was a particular reason policy has this rule; clearly it was intentional. I'll think about this for a bit.
