1

Question

Please suggest how to understand sesearch says.

$ sesearch -s svirt_lxc_net_t -t container_var_run_t -SA
Found 8 semantic av rules:
   allow svirt_sandbox_domain file_type : dir { getattr search open } ; 
   allow svirt_sandbox_domain pidfile : sock_file { write getattr append open } ; 
   allow svirt_sandbox_domain file_type : filesystem getattr ; 
   allow nsswitch_domain pidfile : dir { getattr search open } ; 
   allow domain pidfile : sock_file { write getattr append open } ; 
   allow svirt_sandbox_domain file_type : file entrypoint ; 
   allow nsswitch_domain pidfile : dir { getattr search open } ; 
   allow nsswitch_domain pidfile : dir { getattr search open } ; 

Background

As per How to find an appropriate SELinux type to prevent “permission denied”, trying to find out the cause of "permission denied" due to SELinux.

The process trying to access the object /var/run/docker.sock has svirt_lxc_net_t label and the file has container_var_run_t label. So trying to understand what sesearch says about the relation between svirt_lxc_net_t and container_var_run_t.

https://wiki.gentoo.org/wiki/SELinux/Tutorials/Controlling_file_contexts_yourself shows a trouble shooting tips and it uses sesearch to show the source has few permissions, but not sure how to interpret.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.