<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>
<div style="font-family: Calibri,sans-serif; font-size: 11pt;">I resolved the problem with Dans help by adding a transition from unconfined to vasd_t<br>
<br>
Sent from my Windows Phone</div>
</div>
<div dir="ltr">
<hr>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">From:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:mgrepl@redhat.com">Miroslav Grepl</a></span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Sent:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">3/27/2015 2:24 AM</span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">To:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;"><a href="mailto:swazup@hotmail.com">Jayson Hurst</a>;
<a href="mailto:selinux@lists.fedoraproject.org">selinux@lists.fedoraproject.org</a></span><br>
<span style="font-family: Calibri,sans-serif; font-size: 11pt; font-weight: bold;">Subject:
</span><span style="font-family: Calibri,sans-serif; font-size: 11pt;">Re: How do I create a directory in C that will follow selinux file context rules?</span><br>
<br>
</div>
<div class="BodyFragment">
<div class="PlainText">On 03/26/2015 08:37 PM, Jayson Hurst wrote:<br>
> What I don't understand is why the filetrans doesn't work in the first<br>
> place?<br>
> <br>
> In my policy I define:<br>
> <br>
> filetrans_pattern(vasd_t, vasd_var_t, vasd_var_auth_t, dir )<br>
> <br>
> But when my binary that runs under the vasd_t domain as an unconfined<br>
> user creates a directory in /var/opt/quest/vas/ called vasd it gets<br>
> created as a vasd_var_t.<br>
> <br>
> The parent directory of /var/opt/quest/vas is labeled as vasd_var_t. <br>
> Shouldn't the above filetrans_pattern label all new directories under<br>
> /var/opt/quest/vas as vasd_var_auth_t when they are being created under<br>
> the vasd_t domain?<br>
<br>
It should work. Are you sure you create it under vasd_t? Also you need<br>
to have<br>
<br>
manage_dirs_pattern(vasd_t, vasd_var_auth_t, vasd_var_auth_t)<br>
<br>
> <br>
>> Date: Thu, 26 Mar 2015 18:24:01 +0100<br>
>> From: mgrepl@redhat.com<br>
>> To: swazup@hotmail.com; selinux@lists.fedoraproject.org<br>
>> Subject: Re: How do I create a directory in C that will follow selinux<br>
> file context rules?<br>
>><br>
>> On 03/26/2015 04:17 PM, Jayson Hurst wrote:<br>
>> > RHEL 6.5<br>
>> ><br>
>> > I have tried this using a filestran pattern but it doesn't seem to work.<br>
>> ><br>
>> >> Date: Wed, 25 Mar 2015 09:32:32 +0100<br>
>> >> From: mgrepl@redhat.com<br>
>> >> To: swazup@hotmail.com; selinux@lists.fedoraproject.org<br>
>> >> Subject: Re: How do I create a directory in C that will follow selinux<br>
>> > file context rules?<br>
>> >><br>
>> >> On 03/24/2015 10:45 PM, Jayson Hurst wrote:<br>
>> >> > I need to create a directory in a C binary.<br>
>> >> ><br>
>> >> > I am currently doing something similar to this:<br>
>> >> ><br>
>> >> ><br>
>> >> ><br>
>> >> > status = mkdir("/home/cnd/mod1", S_IRWXU | S_IRWXG | S_IROTH |<br>
> S_IXOTH);<br>
>> >> ><br>
>> >> ><br>
>> >> ><br>
>> >> > But when the directory is created it ends up with the wrong SELinux<br>
>> > context. It inherits it's parent's context and<br>
>> >> ><br>
>> >> > not the one defined in file context.<br>
>> >><br>
>> >> What is your OS?<br>
>> >><br>
>> >> ><br>
>> >> ><br>
>> >> ><br>
>> >> > Is there a C call that can be used that understands how to correctly<br>
>> > create and label SElinux directories?<br>
>> >> ><br>
>> >> ><br>
>> >> ><br>
>> >> > --<br>
>> >> > selinux mailing list<br>
>> >> > selinux@lists.fedoraproject.org<br>
>> >> > <a href="https://admin.fedoraproject.org/mailman/listinfo/selinux">https://admin.fedoraproject.org/mailman/listinfo/selinux</a><br>
>> >> ><br>
>> >><br>
>> >><br>
>> >> --<br>
>> >> Miroslav Grepl<br>
>> >> Software Engineering, SELinux Solutions<br>
>> >> Red Hat, Inc.<br>
>><br>
>> Ok, basically you can add a transition rule for "/home/cnd/mod1"<br>
>><br>
>><br>
>> userdom_user_home_dir_filetrans(unconfined_t, ABC_t, dir)<br>
>><br>
>> It will create a dir in /home/cnd with ABC_t labeling for unconfined_t<br>
>> or for a domain defined by you.<br>
>><br>
>> Where you are not able to use a file transition, you can use restorecond<br>
>> on RHEL6. It uses inotify to watch files listed in<br>
>><br>
>> /etc/selinux/restorecond.conf<br>
>> /etc/selinux/restorecond_user.conf<br>
>><br>
>> when they are created and it sets a context defined in the policy.<br>
>><br>
>> --<br>
>> Miroslav Grepl<br>
>> Software Engineering, SELinux Solutions<br>
>> Red Hat, Inc.<br>
<br>
<br>
-- <br>
Miroslav Grepl<br>
Software Engineering, SELinux Solutions<br>
Red Hat, Inc.<br>
</div>
</div>
</body>
</html>