Re: Selinux and parent/component directory

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Jan 14, 2020 at 11:44 AM Gionatan Danti <g.danti@xxxxxxxxxx> wrote:
> On 14/01/20 10:37, Ondrej Mosnacek wrote:
> > Hi,
> > When you access a path, you usually need only basic permissions
> > (getattr, search, ...) for the parent components and the
> > read/write/execute/... permissions (depending on what the service
> > wants to do with the file) are only checked against the label of the
> > file itself. Chances are that all/most domains already have
> > permissions to traverse mnt_t directories, so it is likely that you
> > won't need any additional permissions. But best to try running the
> > service and see if you get any denials :)
>
> I'll do, thanks.
>
> As a side note, how can I check all permissions of a specific domains
> (ie: libvirt in this case)?

You can use the sesearch tool (from setools-console package). E.g.:

  sesearch -A -s virtd_t

will show you all allow rules with "virtd_t" as the source type. Or:

  sesearch -A -s virtd_t -t mnt_t

will show all allow rules with "virtd_t" as source type and "mnt_t" as
target type. As usual, see the man page for more options.

-- 
Ondrej Mosnacek <omosnace at redhat dot com>
Software Engineer, Security Technologies
Red Hat, Inc.
_______________________________________________
selinux mailing list -- selinux@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to selinux-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/selinux@xxxxxxxxxxxxxxxxxxxxxxx




[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux