From:   Dominick Grift <dac.override@gmail.com>
To:     Russell Coker <russell@coker.com.au>
Cc:     "selinux-refpolicy\@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: nnp_transition
References: <6525171.sqPiMeOL83@liv> <87fttlyuv7.fsf@gmail.com>
        <8870278.Oar1g5JlLj@liv>
Date:   Tue, 22 Jan 2019 09:35:16 +0100
In-Reply-To: <8870278.Oar1g5JlLj@liv> (Russell Coker's message of "Tue, 22 Jan
        2019 19:33:53 +1100")
Message-ID: <87bm49ytrv.fsf@gmail.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

Russell Coker <russell@coker.com.au> writes:

> On Tuesday, 22 January 2019 7:11:40 PM AEDT Dominick Grift wrote:
>> > Getting close to a Debian release so I have to sort out the nnp_transition
>> > rules.  How do I work out what's going on here?  Do I just assume that as
>> > dpkg_t has generally less access than unconfined_t it's ok?  Is it worth
>> > investigating why something in apt is setting NNP?
>> 
>> Not worth looking into if you ask me (this is just the tip of the mountain).
>> You no longer have to worry about type bounds if you enable the polcap
>> (which i think is the default)
>
> What do you mean by "enable the polcap"?

[root@brutus ~]# seinfo --polcap | grep nnp
   nnp_nosuid_transition

-- 
Key fingerprint = 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02
Dominick Grift