[prev in list] [next in list] [prev in thread] [next in thread] 

List:       selinux
Subject:    Re: Domain Transitions (or the Exim4 policy)
From:       "David A. Caplan" <dac () tresys ! com>
Date:       2003-12-19 14:59:05
[Download RAW message or body]

Shane Wegner wrote:
>
>  it does indeed transition to user_mail_t though
> I can't figure out how.  

For future reference, I'd suggest the Reverse Domain Transition analysis 
function in apol (http://www.tresys.com/selinux/) to easily find the 
exact rules in policy.conf that allow a domain to transition to the 
domain in question.

In regard to your other question:
 > I'm seeing user_mail_domain in policies
 > but don't see user_mail_t anywhere save a minor mention
 > in attrib.te.

You can also use apol to find all TE rules related to a type and include 
those rules using the type's attributes by using the Include Indirect 
Matches option under the Policy Rules tab in apol.  The search results 
also provide hyper links into policy.conf so you can trace back where 
the rules came from.  The Policy Components tab can show you all the 
types that use a given attribute.

David
-- 
__________________________________

David Caplan     410 290 1411 x105
dac@tresys.com
Tresys Technology, LLC
8840 Stanford Blvd., Suite 2100
Columbia, MD 21045


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
[prev in list] [next in list] [prev in thread] [next in thread]