Re: Upstream first policy

[Chris Adams]

Once upon a time, Alan Cox  <alan@xxxxxxxxxxxxxxxxxxx> said:
>Its path based in the sense that public_html has a path based meaning by
>convention understood by httpd. Copy a jpeg into your public_html and it
>will be labelled up for http access under the Fedora shipped rule sets.

I'm pretty sure the "copy into a directory" only gets the correct label
by inheritance from the parent directory.

"mkdir public_html" only gets the correct label by running the
restorecond daemon, which is really kind of a hack.  You have a
user-space daemon that watches for creation of specific things with
inotify, and resets their label when a match is found.  It doesn't scale
up to many rules, certainly not the full SELinux list.

-- 
Chris Adams <cmadams@xxxxxxxxxx>
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/