10.5.3. Understanding Domain Transitions: sepolicy transition
Previously, the setrans
utility was used to examine if transition between two domain or process types is possible and printed out all intermediary types that are used to transition between these domains or processes. Now, setrans
is provided as part of the sepolicy
suite and the sepolicy transition
command is now used instead.
The sepolicy transition
command queries a SELinux policy and creates a process transition report. The sepolicy transition
command requires two command-line arguments – a source domain (specified by the -s
option) and a target domain (specified by the -t
option). If only the source domain is entered, sepolicy transition
lists all possible domains that the source domain can transition to. The following output does not contain all entries. The “@” character means “execute”:
~]$
sepolicy transition -s httpd_t
httpd_t @ httpd_suexec_exec_t --> httpd_suexec_t
httpd_t @ mailman_cgi_exec_t --> mailman_cgi_t
httpd_t @ abrt_retrace_worker_exec_t --> abrt_retrace_worker_t
httpd_t @ dirsrvadmin_unconfined_script_exec_t --> dirsrvadmin_unconfined_script_t
httpd_t @ httpd_unconfined_script_exec_t --> httpd_unconfined_script_t
If the target domain is specified, sepolicy transition
examines SELinux policy for all transition paths from the source domain to the target domain and lists these paths. The output below is not complete:
~]$
sepolicy transition -s httpd_t -t system_mail_t
httpd_t @ exim_exec_t --> system_mail_t
httpd_t @ courier_exec_t --> system_mail_t
httpd_t @ sendmail_exec_t --> system_mail_t
httpd_t ... httpd_suexec_t @ sendmail_exec_t --> system_mail_t
httpd_t ... httpd_suexec_t @ exim_exec_t --> system_mail_t
httpd_t ... httpd_suexec_t @ courier_exec_t --> system_mail_t
httpd_t ... httpd_suexec_t ... httpd_mojomojo_script_t @ sendmail_exec_t --> system_mail_t
See the sepolicy-transition(8) manual page for further information about sepolicy transition
.