mirror of
https://github.com/SELinuxProject/selinux
synced 2025-01-11 07:59:26 +00:00
25ce102907
It seems validatetrans support was never added to libselinux, despite being added to selinuxfs in kernel version 4.5 There is a utility to test, however the targeted policy has no validatetrans rules so some must be added: $ cat validatetrans.cil (mlsvalidatetrans db_table (and (or (or (or (eq l1 l2) (and (eq t3 unconfined_t) (domby l1 l2))) (and (eq t3 unconfined_t) (dom l1 l2))) (and (eq t3 unconfined_t) (incomp l1 l2))) (or (or (or (eq l1 h2) (and (eq t3 unconfined_t) (domby h1 h2))) (and (eq t3 unconfined_t) (dom h1 h2))) (and (eq t3 unconfined_t) (incomp h1 h2))))) $ sudo semodule -i validatetrans.cil $ ./validatetrans system_u:system_r:kernel_t:s0 system_u:system_r:init_t:s0:c0 db_table system_u:system_r: # invalid context here opening /sys/fs/selinux/validatetrans security_validatetrans returned -1 errno: Invalid argument $ ./validatetrans system_u:system_r:kernel_t:s0 system_u:system_r:init_t:s0:c0 db_table system_u:system_r:init_t:s0 opening /sys/fs/selinux/validatetrans security_validatetrans returned -1 errno: Operation not permitted $ ./validatetrans system_u:system_r:kernel_t:s0 system_u:system_r:init_t:s0:c0 db_table system_u:system_r:unconfined_t:s0 opening /sys/fs/selinux/validatetrans security_validatetrans returned 0 errno: Success Signed-off-by: Joshua Brindle <joshua.brindle@crunchydata.com> |
||
|---|---|---|
| .. | ||
| .gitignore | ||
| avcstat.c | ||
| compute_av.c | ||
| compute_create.c | ||
| compute_member.c | ||
| compute_relabel.c | ||
| compute_user.c | ||
| getconlist.c | ||
| getdefaultcon.c | ||
| getenforce.c | ||
| getfilecon.c | ||
| getpidcon.c | ||
| getsebool.c | ||
| getseuser.c | ||
| Makefile | ||
| matchpathcon.c | ||
| policyvers.c | ||
| sefcontext_compile.c | ||
| selabel_digest.c | ||
| selabel_lookup_best_match.c | ||
| selabel_lookup.c | ||
| selabel_partial_match.c | ||
| selinux_check_access.c | ||
| selinux_check_securetty_context.c | ||
| selinuxenabled.c | ||
| selinuxexeccon.c | ||
| setenforce.c | ||
| setfilecon.c | ||
| togglesebool.c | ||
| validatetrans.c | ||