On Fri, Apr 30, 2010 at 3:38 PM, Xavier Toth <txtoth@xxxxxxxxx> wrote: > I'm going to simplify this because a lot of the detail isn't import to > the issue I'm working through. I'm taring some files, one of which > happens to be labeled SystemHigh and the rest SystemLow. An init > script, running SystemLow-SystemHigh, is later run on a different > system which untars the file. tar generates a warning message about > setfilecon failing for the file labeled SystemHigh and I see a > SELINUX_ERR message in the audit log (security_validate_transition: > denied for oldcontext=system_u:object_r:selinux_config_t:s0 > newcontext=system_u:object_r:selinux_config_t:s15:c0-c1023 > taskcontext=system_u:system_r:initrc_t=s0-s15:c0.c1023 tclass=file). I > am using run_init to run test this init script. What I'm confused > about is that there are no AVCs (I did an semnodule -DB just to see if > there were any dontaudits) and why there even is a failure as initrc_t > uses the mls_file_write_all_levels marco. Also does anyone know of a > way to see the contexts stored in the tar file? > > Ted > I see now, initrc_t policy doesn't use mls_file_upgrade but I still don't like the no AVC bit. Ted -- selinux mailing list selinux@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/selinux
