Selinux and parent/component directory
Hi all,
I have a question about how selinux match the parent and/or higher
component path directory.
Lets say I want to relocate a service home under /mnt/. For example, I
want to relocate /var/lib/libvirt under /mnt/xfs/var/lib/libvirt. I
understand I can, and should, use selinux equivalency: "semanage
fcontext -a -e /var/lib/libvirt /mnt/xfs/var/lib/libvirt".
So far, so good: a "restorecon -RF /mnt/xfs/var/libv/libvirt" leave the
selinux labels intact.
However, the /mnt/xfs/ component path still (obviously) labeled as type
mnt_t. How will selinux behave in this case? It will only match the
final path component (ie: the "libvirt" dir in
"/mnt/xfs/var/lib/libvirt")? Or should libvirt be enabled to
read/list/execute from mnt_t also?
More broadly: a targeted selinux policy has a list of *enabled* actions,
with all others automatically denied, or "extraneous" labels are just
ignored?
Thanks.
--
Danti Gionatan
Supporto Tecnico
Assyoma S.r.l. - www.assyoma.it
email: g.danti(a)assyoma.it - info(a)assyoma.it
GPG public key ID: FF5F32A8