Re: Selinux and parent/component directory

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

On Tue, Jan 14, 2020 at 10:27 AM Gionatan Danti <g.danti@xxxxxxxxxx> wrote:
>
> Hi all,
> I have a question about how selinux match the parent and/or higher
> component path directory.
>
> Lets say I want to relocate a service home under /mnt/. For example, I
> want to relocate /var/lib/libvirt under /mnt/xfs/var/lib/libvirt. I
> understand I can, and should, use selinux equivalency: "semanage
> fcontext -a -e /var/lib/libvirt /mnt/xfs/var/lib/libvirt".
>
> So far, so good: a "restorecon -RF /mnt/xfs/var/libv/libvirt" leave the
> selinux labels intact.
>
> However, the /mnt/xfs/ component path still (obviously) labeled as type
> mnt_t. How will selinux behave in this case? It will only match the
> final path component (ie: the "libvirt" dir in
> "/mnt/xfs/var/lib/libvirt")? Or should libvirt be enabled to
> read/list/execute from mnt_t also?
>
> More broadly: a targeted selinux policy has a list of *enabled* actions,
> with all others automatically denied, or "extraneous" labels are just
> ignored?

When you access a path, you usually need only basic permissions
(getattr, search, ...) for the parent components and the
read/write/execute/... permissions (depending on what the service
wants to do with the file) are only checked against the label of the
file itself. Chances are that all/most domains already have
permissions to traverse mnt_t directories, so it is likely that you
won't need any additional permissions. But best to try running the
service and see if you get any denials :)

-- 
Ondrej Mosnacek <omosnace at redhat dot com>
Software Engineer, Security Technologies
Red Hat, Inc.
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx




[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux