On Dienstag, 16. März 2004 19:13, Stephen Smalley wrote:
> To debug the newrole failure in enforcing mode, do a 'make
> enableaudit reload' in policy and then try using newrole, and

"make enableaudit" was a good hint. The newrole domain needs read access to shadow_t. The attached patch grant this by using the auth attribute.

Greetings

Carsten

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



text/x-diff attachment: newrole.patch