tree 3270ff7eb4ae37028bbfc823cc7fbeee995be8ff
parent c2c2dc610c995fc4caab6c98c03e13727476136e
author Dominick Grift <dac.override@gmail.com> 1576071863 +0100
committer Petr Lautrbach <plautrba@redhat.com> 1589360943 +0200

mcstrans: start early and stop late

It stopped too early, exposing a bug in sudo selinux_restore_tty():

SELINUX_ERR op=setxattr invalid_context="wheel.id:wheel.role:users.terminals.pty.pty_file:SystemLow"
avc:  denied  { mac_admin } for  pid=859 comm="sudo" capability=33 scontext=wheel.id:wheel.role:sudo.wheel.subj:s0 tcontext=wheel.id:wheel.role:sudo.wheel.subj:s0 tclass=capability2 permissive=0

If we want to be able to reference human readable contexts in SELinuxContext= and nspawn -Z and -L then we need mcstrans ASAP

v2: stop late, but do stop
Signed-off-by: Dominick Grift <dac.override@gmail.com>
Acked-by: Petr Lautrbach <plautrba@redhat.com>