selinux prelink avc's (broken paths in policy?)
Paul Howarth
paul at city-fan.org
Wed May 24 15:38:30 UTC 2006
Christopher Ashworth wrote:
> On Wed, 2006-05-24 at 16:20 +0100, Paul Howarth wrote:
>
>> So in other words, in the event of a tie, the one nearest the bottom of
>> the list (in the file_contexts file or the output of "semanage fcontext
>> -l") is determined to be the most specific and that one wins. Is that right?
>
> When I do "semanage fcontext -l" I don't get an ordered listing (so this
> does not appear to be correct in that case), but yes, this is correct
> for the file_contexts file.
>
> It would be ideal to make the algorithm do a proper sort based on strict
> regular expression subsets, but this is non-trivial and these heuristics
> work pretty well.
So if "semanage fcontext -l" doesn't produce an ordered listing, is
there any way from userland to get one, one that encompasses both the
base policy and any added modules or context objects added using semanage?
I take it as read that semanage-added objects and the file contexts from
policy module packages (.pp files) are seen as "later" in the list than
the base file_contexts file, but which has precedence for
semanage/semodule? Last one in? Does it make a difference whether
"semodule -i" or "semodule -u" are used?
Paul.
More information about the fedora-selinux-list
mailing list