On Jul 26, 2012, at 5:49 PM, Haiqing Jiang <hqjiang1988@xxxxxxxxx> wrote:
> Hi, all
>
> I have the following denials. But from my understanding, the reading-down rule is not violated according to the scontext and tcontext. Could you help to explain why? Thanks.
>
> <5>[15423.456451] type=1400 audit(1342836229.562:2241): avc: denied { read } for pid=2589 comm="ationTestRunner" name="cwd" dev=proc ino=127269 scontext=u:r:release_app:s0:c42 tcontext=u:r:shared_app:s0:c16 tclass=lnk_file
s0:c42 and s0:c16 are incomparable. c42 doesn't dominate c16. There may be additional type issues as well.
joe
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.
