<snip>
SIDs, with the values in ->sid[0] and the context structures in
->context[0]. Richard's sample program showed you how to walk it and
print out all the entries. The symbolic names themselves aren't in the
policydb, as he noted; you can grab it from the kernel source
(linux/security/selinux/include/initial_sid_to_string.h) or from the
refpolicy (run make in refpolicy/policy/flask and grab
kernel/initial_sid_to_string.h).
I was hoping there was something I was missing between what you were
posting and Richards sample. Looks like it's all by ordinal, so
(conjecturing here) initial sid ordering must match the kernel header
ordering as far as I can tell, is that right?
Something must remap it in the kernel from initial sid to class.
I was hoping there would be a clean way to grab this from the policy for
use in fs_config tools under build, but just hard coding the default
context string seems to be the best approach.
I don't know what you are doing, but the initial SID context is not what you want for fs_config. You want the result of selabel_lookup(), just as is done by system/extras/ext4_utils to label files in the generated images.
I came accross this in build/tools/fs_config/fs_config.c:
char* secontext;
if (selabel_lookup(sehnd, &secontext, full_name, ( mode | (is_dir ? S_IFDIR : S_IFREG)))) {
secontext = strdup("u:object_r:unlabeled:s0");
}
printf(" selabel=%s", secontext);
free(full_name);
freecon(secontext);
commit 0eb17d944704b3eb140bb9dded299d3be3aed77e
Author: Nick Kralevich <nnk@xxxxxxxxxx>
I was just poking around at things to figure out what the intent is.
I am assuming I have something like /foobar, it will fail on labeling since their is no match. At which point
you would want to default to the initial sid for file.
I was investigating how difficult it would be to not hardcode this value and retrieve it from sepol, which seems
like more work than its worth.
--
Respectfully,
William C Roberts
William C Roberts
_______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
