State what fields are used when generating SELinux labels from a baselabel. --- Notes: Version 2: - add reference to example docs/formatdomain.html.in | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/docs/formatdomain.html.in b/docs/formatdomain.html.in index 4e9665f..80caac0 100644 --- a/docs/formatdomain.html.in +++ b/docs/formatdomain.html.in @@ -4596,8 +4596,16 @@ qemu-kvm -net nic,model=? /dev/null </dd> <dt><code>baselabel</code></dt> <dd>If dynamic labelling is used, this can optionally be - used to specify the base security label. The format - of the content depends on the security driver in use. + used to specify the base security label that will be used to generate + the actual label. The format of the content depends on the security + driver in use. + + The SELinux driver uses only the <code>type</code> field of the + baselabel in the generated label. Other fields are inherited from + the parent process when using SELinux baselabels. + + (The example above demonstrates the use of <code>my_svirt_t</code> + as the value for the <code>type</code> field.) </dd> <dt><code>imagelabel</code></dt> <dd>This is an output only element, which shows the -- 1.8.2.1