James Ralston <ralston@xxxxxxxxx>: > On Fri, Jun 7, 2019 at 5:26 PM Marko Rauhamaa <marko@xxxxxxxxxx> wrote: >> More interestingly, how do I override the distro transition rule so >> that the file context rule takes precedence? > > You don’t. > > When a file is created, the creation/transition policy applies; when > you run restorecon on a file, the file context policy applies. That's what I decided to do: run restorecon right after creating the file. Problem solved, and the admin likely won't inadvertently relabel the file. >> Based on some extensive googling, I gather I will need an >> >> file_type_auto_trans >> >> declaration. Even some more digging makes me guess this directive >> needs to go in a .te file although it would be nice to find a direct >> answer in the documentation. > > You can look at the reference policy in Github to see how to write > type transitions. > > But it’s probably not going to help you here. Unlike file contexts, > type transitions are exact, and cannot conflict. If your custom > module contains a file transitions that conflicts with a preexisting > transition, SELinux will refuse to load your module. See: > > https://selinuxproject.org/page/NB_Domain_and_Object_Transitions Thanks. Unfortunately, I'd need some sort of a Fedora SELinux policy tutorial to make use of that document. > If you think your distro’s file transitions are too zealous, and are > transitioning new files to the antivirus_db_t context that aren’t > actually antivirus database files, then you should file a bug report > against the distro and get the problem fixed in the upstream policy. Fedora can't possibly know what 3rd-party files are for so I suppose any out-of-the-box label is bound to be just a guess. Now if only I as the application developer knew what the right label were supposed to be... Marko _______________________________________________ selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
