-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 12/05/2010 04:44 PM, Jorge Fábregas wrote:
> On Saturday 04 December 2010 16:41:39 Dominick Grift wrote:
>> So you could define a file type transition:
>>
>> if unconfined_t creates a file in directories with type etc_t, then
>> transition from type etc_t to some specified type (net_conf_t in your
>> example)
>>
>> filetrans_pattern(unconfined_t, etc_t, net_conf_t, file)
>
> Hello again!
>
> I would like to try this out (files created with unconfined_t, under /etc/, to
> have a label of net_conf_t). My only experience with inserting custom-policy
> modules is with the "allow rules" suggested by audit2allow. Other than that I
> have never done anything else policy-wise so bear with me :)
>
> I tried this:
You should remove the ; on the filetrans line
mkdir mytest; cd mytest;
echo "policy_module(mytest, 1.0.0)" > mytest.te;
echo "gen_require(\` type unconfined_t, etc_t, net_conf_t; ')" >> mytest.te;
echo"# allow unconfined_t to create files with type net_conf_t in etc_t
directories. So unconfined_t should be able to traverse etc_t
directories (search) and to add entries to the parent etc_t directories.
this is all provided in the manage_files_pattern" >> mytest.te;
echo "manage_files_pattern(unconfined_t, etc_t, net_conf_t)" >> mytest.te;
echo "Now we must tell selinux to transition the type of the file
created by unconfined_t in etc_t directories from the default etc_t type
to the specified net_conf_t type." >> mytest.te;
echo "filetrans_pattern(unconfined_t, etc_t, net_conf_t, file)" >>
mytest.te;
make -f /usr/share/selinux/devel/Makefile mytest.pp
sudo semodule -i mytest.pp
touch /etc/test
ls -alZ /etc/test
rm /etc/test
sudo semodule -r mytest.pp
> ------------------------------ cut here ---------------------------
>
> module localtran 1.0;
> require {
> type unconfined_t;
> type etc_t;
> type net_conf_t;
> class file {write};
> }
>
> filetrans_pattern(unconfined_t, etc_t, net_conf_t, file);
>
> ------------------------------ cut here ---------------------------
>
> and then tried "checmodule -M -m localtran.te -o localtran.pp" but I get
> syntax errors with token "filetrans_pattern". I did some googling and noticed
> the use of "files_type" and "manage_files" before filetrans_pattern (tried it but
> didn't work). I'm not sure if I need those and also the class directive.
>
> I would like to try this first and eventually get more sophisticated with your
> other suggestions.. Of course, this is just for learning purposes (not that I
> need unconfined_t to create files in /etc with net_conf_t ).
>
> Regards,
> Jorge
> --
> selinux mailing list
> selinux@xxxxxxxxxxxxxxxxxxxxxxx
> https://admin.fedoraproject.org/mailman/listinfo/selinux
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkz73hkACgkQMlxVo39jgT+nyACgogEvZdNgiBaHpCI+urhpbOl1
qL8An2bq2j4YhaEYu9gHylUSE/XBQvz3
=h7Ps
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
