Domain transition procedure
When a process in a domain issued a program execution request, the steps below are performed.
Any occurrence of [source] represents either the current domain name (e.g. <kernel> /usr/sbin/sshd /bin/bash ), or the last part of the current domain name (e.g. /bin/bash ).
Any occurrence of [current_domain] represents the current domain name (e.g. <kernel> /usr/sbin/sshd /bin/bash ).
Any occurrence of [current_namespace] represents the current domain's namespace name (e.g. <kernel> if <kernel> /usr/sbin/sshd /bin/bash ).
Any occurrence of [destination] represents domainname to transit to when the program execution request succeeds (e.g. <kernel> /usr/sbin/sshd /bin/bash /bin/cat ).
Any occurrence of [candidate] represents a pathname which is subjected to permission checks (e.g. /bin/cat ).
Step |
Procedure |
|---|---|
(1) Obtain program pathname |
Calculate the pathname of the requested program and set the pathname as the [candidate]. |
(2) Check for aggregator directive |
If exception policy contains |
(3) Check for file execute directive |
If domain policy contains Otherwise, the execution request is denied if the profile's CONFIG, or CONFIG::file, or CONFIG::file::execute (with the latter overwriting the previous) is set to "mode=enforcing". |
(4) Determine domain transition |
Firstly, if exception policy contains one of
Secondly, if exception policy contains one of
Thirdly, if exception policy contains one of Fourthly, set the [current_domain] [candidate] as the [destination] . |
(5) Create destination domain |
Create the [destination] as determined by step (4) if the [destination] does not exist. If the [destination] as determined by reset_domain entries cannot be created, the execution request is denied. If the [destination] as determined by step (4) cannot be created and the profile's CONFIG, or CONFIG::file, or CONFIG::file::execute (with the latter overwriting the previous) is set to "mode=enforcing", the execution request is denied. |
(6) Check interpreters |
If read permission for the interpreter (if any) is rejected in the [destination] and the profile (CONFIG, or CONFIG::file, or CONFIG::file::open (with the latter overwriting the previous)) for the [destination] is "mode=enforcing", the execution request is denied. |
(7) Execute the program |
If the current process was successfully replaced by the requested program, the current process transits to the [destination] . |