tree 3993de8e2e8c2ba45ce2625708df6373d6681f5e
parent de0795a12edfa8c1239c3165bc4d6c566b6875af
author Andy Lutomirski <luto@amacapital.net> 1399915161 -0400
committer Stephen Smalley <sds@tycho.nsa.gov> 1399918485 -0400

seunshare: Try to use setcurrent before setexec

If seunshare uses PR_SET_NO_NEW_PRIVS, which certain versions of
libcap-ng set, setexeccon will cause execve to fail.  This also
makes setting selinux context the very last action taken by
seunshare prior to exec, as it may otherwise cause things to fail.

Note that this won't work without adjusting the system policy to
allow this use of setcurrent.  This rule appears to work:

    allow unconfined_t sandbox_t:process dyntransition;

although a better rule would probably relax the unconfined_t
restriction.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>