fedora-selinux June 2008 archive
| Main Archive Page > Month Archives > fedora-selinux archives |
Re: What to do about "invalid context"
From: Göran Uddeborg <goeran_at_nospam>Date: Tue Jun 17 2008 - 18:36:48 GMT
To: Stephen Smalley <sds@tycho.nsa.gov>
Stephen Smalley writes:
> role unconfined_r types updpwd_exec_t;
Aha, now I get it! It's the role-type combination that is not allowed, and thus "invalid". Thanks!
A little detail, though. It's the type updpwd_t, not updpwd_exec_t that should be allowed, isn't it? Unless I'm mistaken, it's the file that has the *_exec_t type, but the resulting process domain is *_t.
I did create my module following your pattern, but using updpwd_t, and the crontab command works again. So it seems it was the right thing to do. Or have I done something I shouldn't do after all? -- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list