-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 01/13/2014 11:49 AM, Richard W.M. Jones wrote:
On Mon, Jan 13, 2014 at 10:20:22AM -0500, Daniel J Walsh wrote:
> Secondly we prevent even unconfined_t from putting down labels on the
> file system that the kernel does not understand. IE If I am building a
> F21 image on a RHEL6 box, it would blow up in enforcing mode if run as
> unconfined_t. We added a special policy called livecd_t that is allowed
> to put down labels which the kernel does not understand, and unconfined_t
> will transition to this domain.
Slightly off-topic, but this (in-)ability to label files with labels which
the kernel doesn't know about affects libguestfs negatively too. Is there
some reason why it's bad?
Rich.
Well we could add a label to libguestfs to allow these labels. From the
running kernel point of view you end up with unlabeled_t. We also would like
to prevent users from making mistakes like assigning httpd_t to a file when it
is a process type.
SELinux is going to check before you put the label down unless you have the
mac_admin capability.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird -
http://www.enigmail.net/
iEYEARECAAYFAlLURvoACgkQrlYvE4MpobM8UwCgumLZBVrnwCwwby6jjeKiCXMV
q4QAn3R1avfBzgLHG24DPLEYHSmhAgNE
=YckJ
-----END PGP SIGNATURE-----