On Mon, 2008-11-03 at 12:49 +0100, Andy Warner wrote: > I am running Fedora 9 with the MLS policy and see no evidence that the > label translation is enabled. I am using the default setrans.conf and > the "disable=1" flag is commented out. > > Using the selinux_trans_to_raw (e.g., with a SystemHigh level) > produces the exact same label string as passed in which will not pass > validation (using s15:c0.c1023 will pass validation). > > Trying id-Z followed by newrole produces: > id -Z > warner_u:secadm_r:secadm_t:s0-s15:c0.c1023 > > newrole -l SystemLow-SystemHigh > warner_u:secadm_r:secadm_t:SystemLow-SystemHigh is not a valid context > > Is there something that must be done to activate label translation? Label translation is provided by a daemon, mcstrans. yum install mcstrans /sbin/chkconfig mcstrans on /sbin/service mcstrans start -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
