<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Is it in an optional block? Could you send me your policy?<br>
<br>
<br>
<div class="moz-cite-prefix">On 01/12/2015 11:48 AM, Jayson Hurst
wrote:<br>
</div>
<blockquote cite="mid:BLU181-W459FE6DE8A88DC07F406B4D5430@phx.gbl"
type="cite">
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style>
<div dir="ltr">I declare userdom_home_filetrans_user_home_dir($1)
in vasd_admin method in the vasd.if file. vasd.te calls
vasd_admin(vasd_t). <br>
<br>
$ sesearch -T -s vasd_t -t home_root_t -c file <br>
<br>
$<br>
<br>
The command above returns a blank line.<br>
<br>
Could I there be a conflicting rule that might be causing me
problems. Where do I look to figure out why this no longer
works?<br>
<br>
<div>
<hr id="stopSpelling">Date: Sat, 10 Jan 2015 07:03:17 -0500<br>
From: <a class="moz-txt-link-abbreviated" href="mailto:dwalsh@redhat.com">dwalsh@redhat.com</a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:swazup@hotmail.com">swazup@hotmail.com</a>; <a class="moz-txt-link-abbreviated" href="mailto:selinux@lists.fedoraproject.org">selinux@lists.fedoraproject.org</a><br>
Subject: Re: Creating home directories with wrong context<br>
<br>
<br>
<div class="ecxmoz-cite-prefix">On 01/08/2015 09:22 PM, Jayson
Hurst wrote:<br>
</div>
<blockquote
cite="mid:BLU181-W36B4BDAD4F03DDE83465A9D5440@phx.gbl">
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">I am trying to figure out why a policy that
was written on RHEL 6.0 doesn't work the same on RHEL 6.5.<br>
<br>
I have a policy whose domain is vasd_t <br>
<br>
I am using the userdomain.if interface call which is
supposed to give the domain access to create directories
in the home dir root with the user home directory type.<br>
userdom_home_filetrans_user_home_dir(vasd_t)<br>
<br>
Which calls:<br>
files_home_filetrans($1, user_home_dir_t, dir)<br>
Which calls:<br>
filetrans_pattern($1, home_root_t, $2, $3)<br>
<br>
Which is defined as:<br>
allow $1 $2:dir rw_dir_perms;<br>
type_transition $1 $2:$4 $3;<br>
<br>
I would expect this to allow me to create a new directory
in /home which is of type home_root_t, but what I am
seeing is that the new homedir is being created with the
type of home_root_t and not user_home_dir_t as expected.<br>
<br>
I have also tried not calling the interface methods and
defining it by hand as:<br>
<br>
allow vasd_t home_root_t:dir rw_dir_perms;<br>
type_transition vasd_t home_root_t:dir user_home_dir_t;<br>
<br>
I have also tried calling
userdom_create_user_home_dirs(vasd_t)<br>
<br>
sesearch shows:<br>
<br>
$ sesearch -AC | grep 'allow vasd_t' | grep ': dir' | grep
home_root_t<br>
allow vasd_t home_root_t : dir { ioctl read write
getattr lock add_name remove_name search open } ;<br>
<br>
The way the daemon works that is associated to the vasd_t
domain is that it calls a script that does the actual
creation of the homedir. I believe the problem lies in
this fact that perhaps the script isn't being invoked in a
way to give it proper creation rights.<br>
<br>
Like I said this use to work in RHEL 6.0 but now I cannot
seem to get it to work in 6.5. Any help would be
appreciated. I don't know what I am missing here.<br>
</div>
<br>
<fieldset class="ecxmimeAttachmentHeader"></fieldset>
<br>
<pre>--
selinux mailing list
<a moz-do-not-send="true" class="ecxmoz-txt-link-abbreviated" href="mailto:selinux@lists.fedoraproject.org">selinux@lists.fedoraproject.org</a>
<a moz-do-not-send="true" class="ecxmoz-txt-link-freetext" href="https://admin.fedoraproject.org/mailman/listinfo/selinux" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/selinux</a></pre>
</blockquote>
<br>
You should only need.<br>
userdom_home_filetrans_user_home_dir(vasd_t)<br>
<br>
You need to look at your transition rules.<br>
<br>
sesearch -T -s vasd_t -t home_root_t -c file<br>
<br>
<br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
selinux mailing list
<a class="moz-txt-link-abbreviated" href="mailto:selinux@lists.fedoraproject.org">selinux@lists.fedoraproject.org</a>
<a class="moz-txt-link-freetext" href="https://admin.fedoraproject.org/mailman/listinfo/selinux">https://admin.fedoraproject.org/mailman/listinfo/selinux</a></pre>
</blockquote>
<br>
</body>
</html>