• Eric Paris's avatar
    SELinux: allow default source/target selectors for user/role/range · aa893269
    Eric Paris authored
    When new objects are created we have great and flexible rules to
    determine the type of the new object.  We aren't quite as flexible or
    mature when it comes to determining the user, role, and range.  This
    patch adds a new ability to specify the place a new objects user, role,
    and range should come from.  For users and roles it can come from either
    the source or the target of the operation.  aka for files the user can
    either come from the source (the running process and todays default) or
    it can come from the target (aka the parent directory of the new file)
    
    examples always are done with
    directory context: system_u:object_r:mnt_t:s0-s0:c0.c512
    process context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
    
    [no rule]
    	unconfined_u:object_r:mnt_t:s0   test_none
    [default user source]
    	unconfined_u:object_r:mnt_t:s0   test_user_source
    [default user target]
    	system_u:object_r:mnt_t:s0       test_user_target
    [default role source]
    	unconfined_u:unconfined_r:mnt_t:s0 test_role_source
    [default role target]
    	unconfined_u:object_r:mnt_t:s0   test_role_target
    [default range source low]
    	unconfined_u:object_r:mnt_t:s0 test_range_source_low
    [default range source high]
    	unconfined_u:object_r:mnt_t:s0:c0.c1023 test_range_source_high
    [default range source low-high]
    	unconfined_u:object_r:mnt_t:s0-s0:c0.c1023 test_range_source_low-high
    [default range target low]
    	unconfined_u:object_r:mnt_t:s0 test_range_target_low
    [default range target high]
    	unconfined_u:object_r:mnt_t:s0:c0.c512 test_range_target_high
    [default range target low-high]
    	unconfined_u:object_r:mnt_t:s0-s0:c0.c512 test_range_target_low-high
    Signed-off-by: default avatarEric Paris <eparis@redhat.com>
    aa893269
security.h 6.58 KB