On Mon, 2010-05-03 at 13:23 -0400, Stephen Smalley wrote:
> On Mon, 2010-05-03 at 13:49 -0300, Martin Spinassi wrote:
> > Hi list!
> >
> >
> > I'm trying to figure out how to make domain transition using semanage or
> > any userland command.
> >
> > My problem is that I've just compiled a new version of memcached, and
> > configured it to use the sock file /tmp/memcached.sock, but httpd can't
> > write to it. The scontext is httpd_t, and the dcontext is tmp_t.
> >
> > Probably later I'll make a context for memcached, but by now, I've just
> > find out that I don't really know how to make a domiain transition
> > without having to install selinux source policy, and that's something
> > that I'm really trying to avoid.
> >
> > Any link/doc/tip is really appreciated.
>
> You can create a local policy module without needing to install the
> sources for the base policy.
>
> In simplest form, this might look like:
>
> $ cat mymemcached.te
> policy_module(mymemcached, 1.0)
> require {
> type httpd_t, tmp_t, httpd_tmp_t;
> }
> type_transition httpd_t tmp_t:sock_file httpd_tmp_t;
> allow httpd_t httpd_tmp_t:sock_file { create open read write unlink };
>
> $ make -f /usr/share/selinux/devel/Makefile mymemcached.pp
> $ sudo semodule -i mymemcached.pp
Stephan,
Thank you for your mail!
You answered me, and also sent me the example! I really appreciate it.
It's working perfect now.
Best regards,
Martin
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
