Re: file_type_auto_trans is not sufficient

[Ivan Gyurdiev <ivg2@xxxxxxxxxxx>]

>   At that time, it was
> possible to use them in multi-threaded apps because the fscreate and
> exec contexts are stored per-kernel-thread, NPTL used a 1:1 user:kernel
> threading model, and /proc/self referenced the per-thread state.  Then,
> circa 2.6.0-test6, /proc was suddenly changed such that top-level /proc
> only contains the thread group leaders and /proc/self refers to the
> thread group leader rather than the per-thread state, and you have to
> use /proc/self/task/<tid> to access the per-thread state.  Thus, at
> present, any multi-threaded app will encounter a denial upon attempting
> to use setfscreatecon(3) or setexeccon(3) from a thread other than the
> thread group  leader.  In short, the API doesn't presently allow for use
> by multiple threads, although the implementation could support it (for
> any threading library that uses a 1:1 user-to-kernel threading model).

So other threads will fail to create the desired file in enforcing mode.
This certainly seems like a bad thing...

Would you recommend I go ahead with this setfscreatecon scheme, though?

I don't see any other way to create things in the proper context when
you have two (or more) conflicting file_type_auto_trans rules.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with
the words "unsubscribe selinux" without quotes as the message.