Subject: Re: [PATCH] Add interface to create unit files with specified type
 via filetrans.
To:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
References: <20190111153011.27275-1-dsugar@tresys.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <3fa66aad-edc4-7d66-accd-676b8255928b@ieee.org>
Date:   Sat, 12 Jan 2019 14:30:31 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <20190111153011.27275-1-dsugar@tresys.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 1/11/19 10:30 AM, Sugar, David wrote:
> This is adding an interface to perform a filetrans when creating
> systemd unit files (in systemd_unit_t directory).  Something like this
> is required if creating new unit files for systemd and you want them
> to have something other than the generic systemd_unit_t type.

I'm not against this change, but why wouldn't they be installed by the 
package manager?  It seems less likely that this would be otherwise needed.


> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/system/init.if | 34 ++++++++++++++++++++++++++++++++++
>   1 file changed, 34 insertions(+)
> 
> diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
> index 5beb21e9..caed4867 100644
> --- a/policy/modules/system/init.if
> +++ b/policy/modules/system/init.if
> @@ -3040,6 +3040,40 @@ interface(`init_reload_all_units',`
>   	allow $1 { init_script_file_type systemdunit }:service reload;
>   ')
>   
> +########################################
> +## <summary>
> +##	Create systemd_unit_t objects with a private
> +##	type using a type_transition.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +## <param name="file_type">
> +##	<summary>
> +##	Private file type.
> +##	</summary>
> +## </param>
> +## <param name="class">
> +##	<summary>
> +##	Object classes to be created.
> +##	</summary>
> +## </param>
> +## <param name="name" optional="true">
> +##	<summary>
> +##	The name of the object being created.
> +##	</summary>
> +## </param>
> +#
> +interface(`init_unit_filetrans',`
> +	gen_require(`
> +		type systemd_unit_t;
> +	')
> +
> +	filetrans_pattern($1, systemd_unit_t, $2, $3, $4)
> +')
> +
>   ########################################
>   ## <summary>
>   ##      Allow unconfined access to send instructions to init
> 


-- 
Chris PeBenito