On Tue, 2005-01-04 at 05:03, Russell Coker wrote:
> Allowing the role to be changed requires adding privrole to the attributes of
> domain initrc_t. In that case either the identity system_u must be permitted
> to have the role user1_r or initrc_t also needs the privuser attribute so it
> can launch a process with a different identity.

Role changes also require a role allow rule, e.g. allow foo_r bar_r;

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.