No Denial
Stephen Smalley
sds at epoch.ncsc.mil
Mon Dec 20 21:41:24 UTC 2004
On Mon, 2004-12-20 at 16:39, Browder, Tom wrote:
> Actually, I did a 'make load', rotated my logs to clear them out, and
> then did 'mv /etc/shadow /etc/shadow.save' as a normal user and got a
> long denial log message (get_attr).
Yes, but that is just for the stat(2) attempt (stat => getattr), not for
the rename(2) call, which would never reach the SELinux checks unless
you first pass the Linux DAC checks.
--
Stephen Smalley <sds at epoch.ncsc.mil>
National Security Agency
More information about the fedora-selinux-list
mailing list