October 2004
Intermediate to advanced
256 pages
8h 16m
English
Content preview from SELinuxBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Creating a New Domain
In general, it’s unwise to
create overly large domains, especially domains that include
unrelated programs. The traceroute_t domain
considered in the preceding sections is perhaps such an overweight
domain, since it relates to both the traceroute
and Nmap programs. These programs perform a few somewhat similar
operations, but they’re not closely related. Because
they’re part of a single domain, a vulnerability in
either program could enable an intruder to gain control of the entire
domain. Let’s presume that we prefer to avoid that
fate and see what’s required to create a domain
specific to the Nmap program.
To do so, we’ll follow a procedure that also works in most similar cases:
Determine what files are related to the domain.
Determine the security contexts of these files.
Decide what security contexts are appropriate for the new domain.
Create a basic TE file.
Create a basic FC file that specifies proper labels for files related to the domain.
If necessary, delete conflicting specifications from other FC files.
Load the revised policy and label the domains.
Repeat the following steps as needed:
Test the program.
Tweak the TE or FC files as needed.
Determine What Files Are Related to the Domain
As the procedure directs, let’s start by finding out what files are related to Nmap:
# rpm -ql nmap /usr/bin/nmap /usr/share/doc/nmap-3.50 /usr/share/doc/nmap-3.50/COPYING /usr/share/doc/nmap-3.50/README /usr/share/doc/nmap-3.50/copying.html /usr/share/doc/nmap-3.50/nmap-fingerprinting-article.txt ...Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.