0

in script a.sh:

chown -R root:group parent-folder/

chown -R root:group parent-folder/*

The script runs as root user.

When chown gets executed it show below SELinux violations:

chown : type=1400 audit(0.0:7): avc: denied { dac_override } for capability=1 scontext=u:r:scriptName:s0 tcontext=u:r:scriptName:s0 tclass=capability permissive=1

What do I need to do to avoid the above dac_override ? (I dont want to apply the dac_override SE policy of course)

1

You need to run the process with user/group which has required DAC permissions to access and modify the files. The process can not not change owner of the file without CAP_CHOWN capability. File owner can change the group to another group which the process is member of. Recursive chown also needs to have (at least) search permission to the directory in question.

For more details, see the man pages chown(2) and capabilities(7).

1
  • required DAC permissions to access and modify the files -> The runing process is part of the group , should the group have 7 or 5 ? It is android world, so I made the process root user. Is there anything else I am missing ? – d3xter May 21 '20 at 5:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.