Re: [Libguestfs] selinux question and answer

On 12/08/09 20:04, Richard W.M. Jones wrote: >On Wed, Aug 12, 2009 at 02:41:16PM -0400, Daniel J Walsh wrote: >>F11, F12, F..., RHEL6 ... >>setcon("unconfined_u:unconfined_r:unconfined_t:s0") >> >>RHEL5 >>setcon("user_u:system_r:unconfined_t:s0") >> >>Would be valid, then you do not need to worry about executing a shell. > >Matt maybe we want this patch after all? > Ok. We have a use case (/etc/mtab) which would be broken without this. I'd go ahead and add it. I'm inclined to try setcon to an ordered list of targets, stopping when one works. So far, I think we've got: 1. unconfined_u:unconfined_r:unconfined_t:s0 2. user_u:system_r:unconfined_t:s0 3. system_u:object_r:unconfined_t:s0 sysadm_t was mentioned on our call yesterday as being the root login domain for an MLS policy. What's a good set for MLS?