How did you determine that c42 doesn't dominate c16? Ive been looking at: http://selinuxproject.org/page/NB_MLS I understand that s is for sensitivity and c is for category so their separate entities. But the level is determined by the "level" statement and is combination of s, c and number to determing the level. in mls of sepolicy for Android their is: # Generate level definitions for each sensitivity and category. gen_levels(mls_num_sens,mls_num_cats) How would one specify that one level can dom another? On Thu, Jul 26, 2012 at 6:03 PM, Joe Nall <joe@xxxxxxxx> wrote: > > On Jul 26, 2012, at 5:49 PM, Haiqing Jiang <hqjiang1988@xxxxxxxxx> wrote: > >> Hi, all >> >> I have the following denials. But from my understanding, the reading-down rule is not violated according to the scontext and tcontext. Could you help to explain why? Thanks. >> >> <5>[15423.456451] type=1400 audit(1342836229.562:2241): avc: denied { read } for pid=2589 comm="ationTestRunner" name="cwd" dev=proc ino=127269 scontext=u:r:release_app:s0:c42 tcontext=u:r:shared_app:s0:c16 tclass=lnk_file > > s0:c42 and s0:c16 are incomparable. c42 doesn't dominate c16. There may be additional type issues as well. > > joe > > > > -- > This message was distributed to subscribers of the selinux mailing list. > If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with > the words "unsubscribe selinux" without quotes as the message. -- Respectfully, William C Roberts -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
