-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear all,
I am working on a mean to change the nfs server context depending on the
user who wants to access his files. I have planned to use MCS to do that.
Here is the approach for NFS:
Let us say, we have two users : client1 in s0:c1 and client2 in s0:c2
If client1 wants to access his home directory mounted with NFS, then the
NFS daemon will change his MCS category corresponding to the client MCS
category
That will limit the risk that client2 could access client1's files
Thus, for example my test program is launched in that context :
sysadm_u:sysadm_r:sysadm_t:s0:c1.c2
Then that program makes a setcon in order to move into
sysadm_u:sysadm_r:sysadm_t:s0:c1 and the following step is to move the
program in that context sysadm_u:sysadm_r:sysadm_t:s0:c2
I have written the following semodule :
module localadmin 1.0;
require {
type sysadm_t;
class process setcurrent;
class process dyntransition;
}
allow sysadm_t self:process { setcurrent dyntransition };
The problem is that this setcon does not work. Audit launches a
dyntransition permission denied :
type=AVC msg=audit(1224660818.891:422): avc: denied { dyntransition }
for pid=18334 comm="prog" scontext=sysadm_u:sysadm_r:sysadm_t:s0:c2
tcontext=sysadm_u:sysadm_r:sysadm_t:s0:c1 tclass=process
It also seems impossible to return back to the original context s0:c1.c2
, once s0:c1 is reached
Is it possible to allow this transition?
Thanks you for helping a SElinux newbie
Regards,
Vince
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFJJwn1CkDrToteDh0RAgtMAKC4N4YG9+VIB2u0NtEwYbpSXgvqzACdFc8u
1YhQzdQDTLNfq8hT1Kh0NZY=
=zYx5
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
