[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [Libguestfs] selinux question and answer

On Thu, Aug 13, 2009 at 10:22:03AM +0100, Matthew Booth wrote:
> On 12/08/09 20:04, Richard W.M. Jones wrote:
>> On Wed, Aug 12, 2009 at 02:41:16PM -0400, Daniel J Walsh wrote:
>>> F11, F12, F..., RHEL6 ...
>>> setcon("unconfined_u:unconfined_r:unconfined_t:s0")
>>> RHEL5
>>> setcon("user_u:system_r:unconfined_t:s0")
>>> Would be valid, then you do not need to worry about executing a shell.
>> Matt maybe we want this patch after all?
> Ok. We have a use case (/etc/mtab) which would be broken without this.  
> I'd go ahead and add it.
> I'm inclined to try setcon to an ordered list of targets, stopping when  
> one works. So far, I think we've got:
> 1. unconfined_u:unconfined_r:unconfined_t:s0
> 2. user_u:system_r:unconfined_t:s0
> 3. system_u:object_r:unconfined_t:s0
> sysadm_t was mentioned on our call yesterday as being the root login  
> domain for an MLS policy. What's a good set for MLS?

I'm not even sure what "MLS" is.

Anyway, isn't there a way to get this from the /etc/selinux
configuration of the guest?  For example on a Fedora 10 machine I see:

$ cat /etc/selinux/targeted/contexts/default_type 

$ cat /etc/selinux/targeted/contexts/default_contexts 
system_r:crond_t:s0        system_r:system_crond_t:s0
system_r:local_login_t:s0  user_r:user_t:s0
system_r:remote_login_t:s0 user_r:user_t:s0
system_r:sshd_t:s0         user_r:user_t:s0
system_r:sulogin_t:s0      sysadm_r:sysadm_t:s0
system_r:xdm_t:s0          user_r:user_t:s0


Richard Jones, Emerging Technologies, Red Hat  http://et.redhat.com/~rjones
New in Fedora 11: Fedora Windows cross-compiler. Compile Windows
programs, test, and build Windows installers. Over 70 libraries supprt'd
http://fedoraproject.org/wiki/MinGW http://www.annexia.org/fedora_mingw

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]