Hi all,
I have a question about how selinux match the parent and/or higher
component path directory.
Lets say I want to relocate a service home under /mnt/. For example, I
want to relocate /var/lib/libvirt under /mnt/xfs/var/lib/libvirt. I
understand I can, and should, use selinux equivalency: "semanage
fcontext -a -e /var/lib/libvirt /mnt/xfs/var/lib/libvirt".
So far, so good: a "restorecon -RF /mnt/xfs/var/libv/libvirt" leave the
selinux labels intact.
However, the /mnt/xfs/ component path still (obviously) labeled as type
mnt_t. How will selinux behave in this case? It will only match the
final path component (ie: the "libvirt" dir in
"/mnt/xfs/var/lib/libvirt")? Or should libvirt be enabled to
read/list/execute from mnt_t also?
More broadly: a targeted selinux policy has a list of *enabled* actions,
with all others automatically denied, or "extraneous" labels are just
ignored?
Thanks.
--
Danti Gionatan
Supporto Tecnico
Assyoma S.r.l. - www.assyoma.it
email: g.danti@xxxxxxxxxx - info@xxxxxxxxxx
GPG public key ID: FF5F32A8
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
