foresee policy triggered by a process

[Henry Zhang]

Hi Folks,

I want to trace policy triggered by a process from the command line. Tried
ps -Z $(pgrep cmd)    ----> cmd is either command or executable file name

But it does not pick up any policy type.

Any suggestions?

Thanks.

----henry

[Vit Mojzis]

Hello Henry,
not sure if I understand correctly, but "ps -Z" should give you policy 
context

$  ps -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 749616 pts/10 
00:00:00 bash
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 749665 pts/10 
00:00:00 ps
You can see that I'm running bash (and "ps") as unconfined_u user in 
unconfined_r role and in unconfined_t domain (the last part is probably 
what you are looking for).

$ ps -Z $(pgrep systemd)
system_u:system_r:init_t:s0           1 ?        Ss     0:13 
/usr/lib/systemd/systemd rhgb --system --deserialize 28
^^^ systemd is running in init_t domain
system_u:system_r:systemd_logind_t:s0 1592 ?     Ss     0:03 
/usr/lib/systemd/systemd-logind
^^^ systemd-logind is running in systemd_logind_t domain

Vit

On 4/11/23 19:50, Henry Zhang wrote:
> Hi Folks,
>
> I want to trace policy triggered by a process from the command line. 
> Tried
> ps -Z $(pgrep cmd)    ----> cmd is either command or executable file name
>
> But it does not pick up any policy type.
>
> Any suggestions?
>
> Thanks.
>
> ----henry
>
> selinux mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]...
> Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue