On Mon, 2011-08-01 at 17:45 +0200, Martin Christian wrote: > Hi, > > excuse this very basic question: How can I define a transition for a socket? > > Let's assume I've got a process p with label u_t, denoted as p:u_t. The > process opens a listening tcp socket s on port 80 (e. g. nc -l -p 80). > As far as I understood, s would get the label from the process: s:u_t. > However, I would like the socket to have label o_t. Hence, I define a > transition: > > (u, u) -> o > > or in policy syntax; > > type_transition u_t u_t:tcp_socket o_t; > > But this doesn't seem to work. Any ideas? > Kernel version? Support for type transitions on sockets was first introduced in kernel 2.6.39. Older kernels would always label sockets with their creator's context or with the context specified by the application using setsockcreatecon(3) from libselinux. -- Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
