Re: pipefs issue

On Wed, 2007-05-30 at 18:23 -0700, Clarkson, Mike R (US SSA) wrote:
> I've got a java process running in the datalabeler_t domain at the s2
> mls level, which kicks off a c++ executable in the import_t domain.
>
> There appears to be some inter-process communication being set up using
> pipefs between the parent and child process which is causing mls
> constraint issues. I'm not familiar with pipefs and I'm not explicitly
> creating this communication, either linux or java is implicitly creating
> it for me.
>
> Is this configurable so that I can prevent the pipefs from being
> created?

Unnamed pipes are created on pipefs. My guess is that stdin/out/err are being redirected through a pipe.

> Alternatively, can I satisfy the below AVC denial messages without
> giving the import_t domain mlsfilereadup privilege? I don't mind giving
> the datalabeler_t domain extra privileges like writedown or readup, but
> I don't want to give the import_t domain those kind of mls privileges.

You could dontaudit it.

dontaudit import_t datalabeler_t:fifo_file { read write };

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.