On 14/01/20 10:37, Ondrej Mosnacek wrote:
Hi,
When you access a path, you usually need only basic permissions
(getattr, search, ...) for the parent components and the
read/write/execute/... permissions (depending on what the service
wants to do with the file) are only checked against the label of the
file itself. Chances are that all/most domains already have
permissions to traverse mnt_t directories, so it is likely that you
won't need any additional permissions. But best to try running the
service and see if you get any denials :)
I'll do, thanks.
As a side note, how can I check all permissions of a specific domains
(ie: libvirt in this case)?
Thanks.
--
Danti Gionatan
Supporto Tecnico
Assyoma S.r.l. - www.assyoma.it
email: g.danti@xxxxxxxxxx - info@xxxxxxxxxx
GPG public key ID: FF5F32A8
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx
