Hello, I'm doing a testing for SELinux, so far I have create a domain for a special program. It does work correctly. I have not given the domain any permissions to access any top leve directories or their subdirectories since I am running it in chroot. The thing when it came to testing now, I have created some bash files, and labelled with with exec as the entry to the domain. But even after changing the default security context for these bash files, when executing them, the still be in unconfined domain instead of entering the new domain for testing. Anyone can identify where is the problem?
Thanks in advance
_________________________________________________________________ Windows Live Messenger: Thanks for 10 great years—enjoy free winks and emoticons. http://clk.atdmt.com/UKM/go/157562755/direct/01/
On Tue, 11 Aug 2009 17:26:02 +0100 John Smith linuxking@live.com wrote:
Hello, I'm doing a testing for SELinux, so far I have create a domain for a special program. It does work correctly. I have not given the domain any permissions to access any top leve directories or their subdirectories since I am running it in chroot. The thing when it came to testing now, I have created some bash files, and labelled with with exec as the entry to the domain. But even after changing the default security context for these bash files, when executing them, the still be in unconfined domain instead of entering the new domain for testing. Anyone can identify where is the problem?
Transitioning to a domain usually happens via an initscript; if you want to be able to transition to your new domain from an unconfined domain, you'll need to add that transition specifically into your policy.
Is your program normally started from an initscript?
Paul.
On Tue, 2009-08-11 at 17:26 +0100, John Smith wrote:
Hello, I'm doing a testing for SELinux, so far I have create a domain for a special program. It does work correctly. I have not given the domain any permissions to access any top leve directories or their subdirectories since I am running it in chroot. The thing when it came to testing now, I have created some bash files, and labelled with with exec as the entry to the domain. But even after changing the default security context for these bash files, when executing them, the still be in unconfined domain instead of entering the new domain for testing. Anyone can identify where is the problem?
Do the bash scripts have the #!/bin/bash header? If not, then the kernel won't execute them and bash will fall back to reading them as input files, in which case they won't transition.
If you strace the script with and without the header, you'll see that the actual sequence differs.
selinux@lists.fedoraproject.org