-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/04/2010 12:40 PM, Sandra Rueda wrote:
> Hello,
>
> I am getting the following rule in my SELinux policy:
> allow user_t security_t:file {read write};
>
> I traced it and I found the interface selinux_validate_context grants permissions to read and write files with type security_t.
> Are these permissions required to validate a security context?
> Should they be granted to user_t?
>
> Thanks,
> Sandra
>
> --
> selinux mailing list
> selinux@xxxxxxxxxxxxxxxxxxxxxxx
> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
>
The way a security context is validated is by writing to the
/security/context kernel interface. Which would generate this AVC. If
you want the user_t user to be able to validate a context, then you need
this interface.
A better solution would probably be to write policy for the application
that the user is executing that needs to validate policy and allow this
the access.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvgUOgACgkQrlYvE4MpobNSxwCg1lWRxrTE/x/shfZJ04BNXJE3
2WwAoI/b5LZbIrhGkz4fNLLeWeFQFUmS
=5QKI
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
