-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Currently we can setup certain domains to be allowed to execute labeled init scripts. If we go away from init scripts we will need a mechanism for init to look at the calling program label to figure out if it is allowed to start/stop certain domains. Can webadm_t start/stop mysqld_t? Can webadm_t start/stop httpd_t? # id -Z staff_u:webadm_r:webadm_t:s0-s0:c0.c1023 # systemctl start httpd.service # systemctl stop httpd.service Another option would be just whether label /lib/systemd/system/mysqld.service something that webadm_t is not allowed to read. Ideas? -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk4cuKUACgkQrlYvE4MpobMOygCg5fegKSSt82AuW6DtrS6GphDH OPwAn0S6Y0+q4XFyqSBs2hIyrfgWlZ8o =InWv -----END PGP SIGNATURE----- -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
