Creating exec, run, and transition interfaces
Service domains usually have a few binaries that are executed by user domains or through other service or application domains. Each case of these executions need to be properly investigated to see if a domain transition is needed (that is, a specific domain needs to be created for that execution environment) or if the command can run within the privileges of the caller domain.
From an interface point of view, this is provided through the _exec, _run, and _domtrans interfaces.
How to do it…
Execution-related interfaces allow for other policy modules to define the interaction with this application. This interaction can be a regular execution, but can also contain a domain transition to switch the application ...
Get SELinux Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
