On Mon, 2008-11-03 at 12:49 +0100, Andy Warner wrote:
> I am running Fedora 9 with the MLS policy and see no evidence that the
> label translation is enabled. I am using the default setrans.conf and
> the "disable=1" flag is commented out.
>
> Using the selinux_trans_to_raw (e.g., with a SystemHigh level)
> produces the exact same label string as passed in which will not pass
> validation (using s15:c0.c1023 will pass validation).
>
> Trying id-Z followed by newrole produces:
> id -Z
> warner_u:secadm_r:secadm_t:s0-s15:c0.c1023
>
> newrole -l SystemLow-SystemHigh
> warner_u:secadm_r:secadm_t:SystemLow-SystemHigh is not a valid context
>
> Is there something that must be done to activate label translation?

Label translation is provided by a daemon, mcstrans.

yum install mcstrans
/sbin/chkconfig mcstrans on
/sbin/service mcstrans start

-- 
Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.