SELinux Cookbook

Creating a stream-connect interface

Be it through the specific executable types or by the generic bin_t labeled commands, executions that remain in the caller domain might still require additional privileges to be assigned to the caller domain. These additional privileges could be reading of configuration files or interacting with the main domain through Unix domain sockets or TCP/UDP sockets.

In this recipe, we'll set up a stream-connect interface (as the other privilege enhancements are already covered through the regular resource-access interfaces or network-access interfaces).

How to do it…

Interaction with an application socket can be done either through a socket file or through a named Unix domain socket. This is application-specific, so consulting ...