[Libguestfs] selinux question and answer

[Matthew Booth]

On 12/08/09 20:04, Richard W.M. Jones wrote:
> On Wed, Aug 12, 2009 at 02:41:16PM -0400, Daniel J Walsh wrote:
>> F11, F12, F..., RHEL6 ...
>> setcon("unconfined_u:unconfined_r:unconfined_t:s0")
>>
>> RHEL5
>> setcon("user_u:system_r:unconfined_t:s0")
>>
>> Would be valid, then you do not need to worry about executing a shell.
>
> Matt maybe we want this patch after all?
>

Ok. We have a use case (/etc/mtab) which would be broken without this. 
I'd go ahead and add it.

I'm inclined to try setcon to an ordered list of targets, stopping when 
one works. So far, I think we've got:

1. unconfined_u:unconfined_r:unconfined_t:s0
2. user_u:system_r:unconfined_t:s0
3. system_u:object_r:unconfined_t:s0

sysadm_t was mentioned on our call yesterday as being the root login 
domain for an MLS policy. What's a good set for MLS?

Thanks,

Matt
-- 
Matthew Booth, RHCA, RHCSS
Red Hat Engineering, Virtualisation Team

M:       +44 (0)7977 267231
GPG ID:  D33C3490
GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490