I see. In that case I am not going to push this topic much further. Thanks for your assistance!<br><br>But wouldn't it be nice to have an allow mechanism in SELinux in which I could grant access based on it's existing access. What I want to achieve is to be able to add a rule like "If process can read etc_t, then it can also read etc_foo_t"
<br><br>That would allow me to change context of individual files, and grant access to them by process who already have etc_t, and I wouldn't have to redefine almost the entire selinux context tree just to target a few individual files in /etc for my app.
<br><br>T.<br><br><div><span class="gmail_quote">On 9/18/07, <b class="gmail_sendername">Daniel J Walsh</b> <<a href="mailto:dwalsh@redhat.com">dwalsh@redhat.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
-----BEGIN PGP SIGNED MESSAGE-----<br>Hash: SHA1<br><br>Torbjørn Lindahl wrote:<br>> Good point.<br>> I probably can live with that.<br>><br>> Still I am not sure if I would like it to have full access to all files
<br>> labelled etc_t . It would be nice to be able to single out only a few of<br>> them. Perhaps I should look at something other than the targeted policy.<br>><br>> On 9/17/07, Daniel J Walsh <<a href="mailto:dwalsh@redhat.com">
dwalsh@redhat.com</a>> wrote:<br>> Torbjørn Lindahl wrote:<br>>>>> Hello, I am writing an application that I want to limit using selinux.<br>>>>><br>>>>> audit.log shows that it wants access to /etc/nsswitch.conf and
<br>> /etc/hosts -<br>>>>> which doesn't seem to unreasonable, however both these have types etc_t<br>> ,<br>>>>> and allowing myapp_t to read etc_t would also give it access to for<br>> example
<br>>>>> /etc/passwd, which i do not want.<br>>>>><br>>>>><br>>>>> Do I have to invent a new type for these two files to be able to keep my<br>>>>> application from the other etc_t files in /etc ?
<br>>>>><br>>>>><br>>>>><br>>>>><br>>>>><br>>>>> ------------------------------------------------------------------------<br>>>>><br>>>>> --
<br>>>>> fedora-selinux-list mailing list<br>>>>> <a href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a><br>>>>> <a href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">
https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a><br>> Yes you can, but the more different file_context that you have in /etc,<br>> the harder they will be to maintain.<br>><br>> Reading /etc/passwd is not as dangerous as being able to read
<br>> /etc/shadow. So consider if this is really necessary.<br>>><br><br>> ------------------------------------------------------------------------<br><br>> --<br>> fedora-selinux-list mailing list<br>>
<a href="mailto:fedora-selinux-list@redhat.com">fedora-selinux-list@redhat.com</a><br>> <a href="https://www.redhat.com/mailman/listinfo/fedora-selinux-list">https://www.redhat.com/mailman/listinfo/fedora-selinux-list</a>
<br>All of the current policies including mls allow reading of etc_t for<br>most domains, and /etc/passwd is labeled etc_t.<br>-----BEGIN PGP SIGNATURE-----<br>Version: GnuPG v1.4.7 (GNU/Linux)<br>Comment: Using GnuPG with Fedora -
<a href="http://enigmail.mozdev.org">http://enigmail.mozdev.org</a><br><br>iD8DBQFG8AFbrlYvE4MpobMRAtxMAKCXrwFqgATmTBQoNip52wmaHXFowQCgj0Ld<br>Jz2zh2M8ID/nkU4Rgod4UVw=<br>=8+JV<br>-----END PGP SIGNATURE-----<br></blockquote>
</div><br><br clear="all"><br>-- <br>mvh<br>Torbjørn Lindahl