0

I'm using SELinux (targeted mode) to confine a custom application . I used the command sepolicy generate --init to automatically generate the contexts and rules, and everything went surprisingly well: all the resources are tagged with custom contexts, the applications works well.

However, I'm surprised that the configuration files under /etc/customApplication are still tagged with the etc_t context.

Is there a reason why sepolicy generate --init doesn't create a new etc_t_customApplication context for these files?

0

etc_t is an SELinux type applied by default as part of an SELinux context to files under /etc which are world-readable but owned and modifiable by root only - @fpmurphy

In case you need to modify these configuration files using other applications/deamons or you need to hide these files from everything else you may indeed need your own context.

1
  • Perhaps the first sentence should be modified to: etc_t is an SELinux type applied by default as part of an SELinux context to files under /etc which are world-readable but owned and modifiable by root only. – fpmurphy May 21 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.