Hi, On Tue, Jan 14, 2020 at 10:27 AM Gionatan Danti <g.danti@xxxxxxxxxx> wrote: > > Hi all, > I have a question about how selinux match the parent and/or higher > component path directory. > > Lets say I want to relocate a service home under /mnt/. For example, I > want to relocate /var/lib/libvirt under /mnt/xfs/var/lib/libvirt. I > understand I can, and should, use selinux equivalency: "semanage > fcontext -a -e /var/lib/libvirt /mnt/xfs/var/lib/libvirt". > > So far, so good: a "restorecon -RF /mnt/xfs/var/libv/libvirt" leave the > selinux labels intact. > > However, the /mnt/xfs/ component path still (obviously) labeled as type > mnt_t. How will selinux behave in this case? It will only match the > final path component (ie: the "libvirt" dir in > "/mnt/xfs/var/lib/libvirt")? Or should libvirt be enabled to > read/list/execute from mnt_t also? > > More broadly: a targeted selinux policy has a list of *enabled* actions, > with all others automatically denied, or "extraneous" labels are just > ignored? When you access a path, you usually need only basic permissions (getattr, search, ...) for the parent components and the read/write/execute/... permissions (depending on what the service wants to do with the file) are only checked against the label of the file itself. Chances are that all/most domains already have permissions to traverse mnt_t directories, so it is likely that you won't need any additional permissions. But best to try running the service and see if you get any denials :) -- Ondrej Mosnacek <omosnace at redhat dot com> Software Engineer, Security Technologies Red Hat, Inc. _______________________________________________ selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
