Re: Introducing SELinux Sanbox

[Daniel J Walsh <dwalsh@redhat.com>]

On 05/26/2009 01:12 PM, Justin Mattock wrote:
> On Tue, May 26, 2009 at 8:33 AM, Daniel J Walsh<dwalsh@redhat.com>  wrote:
>> For those who do not ordinarily read my blog.
>>
>> http://danwalsh.livejournal.com/28545.html
>>
>>
>> --
>> This message was distributed to subscribers of the selinux mailing list.
>> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
>> with
>> the words "unsubscribe selinux" without quotes as the message.
>>
>
> hey, nice article.
> What are your thoughts about
> flashplayer?
> I myself enjoy watching T.V. through flash,
> although seeing all of the avc's generated does scare me a bit.
> even though the avc's are just {read, geattr, search, open}
> (looked into gnash, but compiling that from source requires quit a bit)
>
> If only flash could be as simple as watching T.V. through mplayer,
> which generates far less avc's.
>
Flash should work with nsplugin_t if you turn on the
allow_unconfined_nsplugin_transition
boolean

You should not be seeing any avc's from this in F10/F11.  You might need 
to fix the labeling in your homedir.

restorecon -R -v ~/


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.