Re: SELinux type transition rule not working

[Jason Zaman <jason@perfinion.com>]

On Wed, Mar 01, 2017 at 05:51:01PM -0600, Ian Pilcher wrote:
> On 03/01/2017 05:28 PM, Ian Pilcher wrote:
> > Per Lennart's response, systemd *should* be honoring the file context
> > rules when creating the directory.  It's almost as if the directory is
> > being created with the proper context, but something is changing it
> > after the fact.  I have absolutely no idea what that might be, though.

Try using auditd to get details on everything going on in there:
auditctl -w /var/run/squoxy -p rwa -k watchsquoxy

then start things up and get everything matching with:
ausearch -k watchsquoxy

also, not sure if it was just weirdness in your email formatting, but
you dont need the ^ at the front of an fcontext:
^/var/run/squoxy

-- Jason

> Hmm.  Just for grins, I created a tmpfiles config file:
> 
> d /run/squoxy 0755 nobody nobody - -
> 
> This gives me the correct context on the directory:
> 
> drwxr-xr-x. nobody nobody system_u:object_r:squoxy_var_run_t:s0 /run/squoxy
> 
> -- 
> ========================================================================
> Ian Pilcher                                         arequipeno@gmail.com
> -------- "I grew up before Mark Zuckerberg invented friendship" --------
> ========================================================================
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.