A_t
creates a specified object class in a directory labeled B_t
and the specified object class is named objectname
, it gets the label C_t
. This mechanism provides more fine-grained control over processes on the system.
etc_t
, then the file is labeled also etc_t
. However, this method is useless when it is desirable to have multiple files within a directory with different labels.
A_t
creates a specified object class in a directory labeled B_t
, the object gets the new C_t
label. This practice is problematic if a single program creates multiple objects in the same directory where each object requires a separate label. Moreover, these rules provide only partial control, because names of the created objects are not specified.
strcmp()
function. Use of regular expressions or wildcard characters is not considered.
Note
Example 10.1. Examples of Policy Rules Written with File Name Transition
filetrans_pattern(unconfined_t, admin_home_t, ssh_home_t, dir, ".ssh")
unconfined_t
type creates the ~/.ssh/
directory in a directory labeled admin_home_t
, the ~/.ssh/
directory gets the label ssh_home_t
.
filetrans_pattern(staff_t, user_home_dir_t, httpd_user_content_t, dir, "public_html") filetrans_pattern(thumb_t, user_home_dir_t, thumb_home_t, file, "missfont.log") filetrans_pattern(kernel_t, device_t, xserver_misc_device_t, chr_file, "nvidia0") filetrans_pattern(puppet_t, etc_t, krb5_conf_t, file, "krb5.conf")
Note