From:   "Sugar, David" <dsugar@tresys.com>
To:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH] Add interface to create unit files with specified type via
 filetrans.
Thread-Topic: [PATCH] Add interface to create unit files with specified type
 via filetrans.
Thread-Index: AQHUqcKiGjlkq0r8eUGv6VWBzPMufg==
Date:   Fri, 11 Jan 2019 15:30:51 +0000
Message-ID: <20190111153011.27275-1-dsugar@tresys.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1;BN6PR15MB1378;6:rmnZE+q0N4jHRBPJ+F7xASxacLbnUVy6fue/Z6ZuFe7oH4L0Q+l5iGk1gx+6npY+ocnaBpyFfPIj/+6ge4N+blAkScVsL71tk6G67lP+E+LQLWVzpOkw55TAC7c/86FuQg11NT9PXzjsn0zDlz9gVA2tlroVA8w5+xCEntnkDt24589973R0Z5tmcAU9IF2AkH1C9Bznzt4TOAecGEL9tosXdDXZtEy2aJuGlKFehkUxbE2AWyHj2C77uSZunHs8OE+jb8aZGqcAgWr281vV8S3cFUXESfHJGhAmqsaKlXiiIkQA6IoCCptXImLiImiTLSwiIZ3knrnG2V/+Hn9eI929r6jorBzUWTLI7P2G5tduXhn5W1HMiNqjX53NZYR5+JLRDvE6zqFLIXInNyos8LXTOhGi/poTZNxi9NlIbwfmkVlknSvwnvoZGGXxfeVBVXXsNncOsatE6/5Vrdq5fA==;5:sxEKVLnfVmp7nRpsHGxsZl8n2ut7yRmBgLa/og8ov15AZHtVnh/DQ5Ld4OP25akdGDF00wWNygg1HeAYXKwGN+I9KBdCVCom//dQhldXkog7N+6qpxrN/OKAnXOha1TGgKSZS3M8sfr7Hepb0Jfw3NCRXDP8Cmk/EpT1hkkTay85VnPBYoRwqojTj7o6A/E9ZTfHpH2zVbrK1TLkLAtsow==;7:sYm5/aOckzcZ+X3J4rRiOf0WqVA6NIt6bTi7IyY1TVu0wRWDWp+IMAIjQTxHHIulpbXC+3OlK0BMzf1Z7Kd7G8Ra8RsOvxHntdq7tRc6CRBuVenlW9G60xfybn4Zez8QgOLq12GcDY9NNmkAvgvQiA==
x-ms-office365-filtering-correlation-id: 10bb2e51-ca7c-4016-24ba-08d677d9c4fa
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600109)(711020)(2017052603328)(7153060)(7193020);SRVR:BN6PR15MB1378;
x-ms-traffictypediagnostic: BN6PR15MB1378:
x-microsoft-antispam-prvs: <BN6PR15MB13788A4464ED240ACD32C30EB9850@BN6PR15MB1378.namprd15.prod.outlook.com>
x-forefront-prvs: 09144DB0F7
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(39830400003)(376002)(366004)(136003)(346002)(396003)(189003)(199004)(316002)(86362001)(14444005)(6916009)(36756003)(66066001)(256004)(97736004)(508600001)(99286004)(14454004)(5660300001)(71200400001)(71190400001)(105586002)(106356001)(2906002)(26005)(102836004)(2351001)(6506007)(386003)(53936002)(6512007)(6116002)(3846002)(7736002)(52116002)(486006)(476003)(2616005)(8676002)(81156014)(8936002)(186003)(2501003)(6486002)(81166006)(5640700003)(6436002)(305945005)(68736007)(1076003)(25786009);DIR:OUT;SFP:1102;SCL:1;SRVR:BN6PR15MB1378;H:BN6PR15MB1507.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: 8Rbp22Wf6VB8Q36MqEz7uFjgUtvn1oGZ2OKBwXwrSztpdiODWsdnnz2lOZwgQ4Fj6gJ9nZtagtqg9sLYiank+Rlz9jnE7m1CfEsIWkoMqGTJouQUkkkm83TS0hqK3p9dUAlDxNGeedcID+2nAWQ/RnmB/wJ+07/kQ5vrRfaXgDOJlpcdxwclhIbohB7o6+HHHN2srAdIBWH/xYC3RpCH/1Sn4fLsFUQX6p7in1YwmwJZq9fZ0iUNo7DpFXAQq7JFtYzvMr8pcSyRnfPe5NMHS0M6vdPTRrTxwgUuQTlYF+Avf2rOZGNYrJB812IG7FC2gIKUsyQ8RB6zJfg1UMFlqBABCUAcMkbZB4umE5m0Nn/EPLzi4Ixb9BLDCD/rWVQNHoIID5puh5x91YTKrIP085Xfk69Mx6ErMtqYAjWzhro=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: tresys.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 10bb2e51-ca7c-4016-24ba-08d677d9c4fa
X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Jan 2019 15:30:51.9703
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR15MB1378
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

This is adding an interface to perform a filetrans when creating
systemd unit files (in systemd_unit_t directory).  Something like this
is required if creating new unit files for systemd and you want them
to have something other than the generic systemd_unit_t type.

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/system/init.if | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 5beb21e9..caed4867 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -3040,6 +3040,40 @@ interface(`init_reload_all_units',`
 	allow $1 { init_script_file_type systemdunit }:service reload;
 ')
=20
+########################################
+## <summary>
+##	Create systemd_unit_t objects with a private
+##	type using a type_transition.
+## </summary>
+## <param name=3D"domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name=3D"file_type">
+##	<summary>
+##	Private file type.
+##	</summary>
+## </param>
+## <param name=3D"class">
+##	<summary>
+##	Object classes to be created.
+##	</summary>
+## </param>
+## <param name=3D"name" optional=3D"true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`init_unit_filetrans',`
+	gen_require(`
+		type systemd_unit_t;
+	')
+
+	filetrans_pattern($1, systemd_unit_t, $2, $3, $4)
+')
+
 ########################################
 ## <summary>
 ##      Allow unconfined access to send instructions to init
--=20
2.20.1