Date:   Mon, 4 Mar 2019 14:59:50 +0100
From:   Dominick Grift <dac.override@gmail.com>
To:     Russell Coker <russell@coker.com.au>
Cc:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: strange daemon startup issue
Message-ID: <20190304135950.GA22313@brutus.lan>
Mail-Followup-To: Russell Coker <russell@coker.com.au>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <3166760.egoGarHQ6g@xev>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="/04w6evG8XlLl3ft"
Content-Disposition: inline
In-Reply-To: <3166760.egoGarHQ6g@xev>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--/04w6evG8XlLl3ft
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Mar 05, 2019 at 12:29:45AM +1100, Russell Coker wrote:
> When I boot kernel 4.9.144 (Debian/Stable kernel) with the Debian policy =
for=20
> Unstable (which isn't very different to the latest Git refpolicy) /usr/sb=
in/
> ModemManager and /usr/sbin/mysqld run as init_t.
>=20
> When I boot the same policy with kernel 4.19.16 (Debian/Testing kernel) t=
hose=20
> daemons run in modemmanager_t and mysqld_t as desired.
>=20
> What is the difference between those kernels which would explain this?  W=
ould=20
> it be some interaction with systemd?  I don't expect anyone to just hand =
me=20
> the answer (although that would be really nice), any clues as to where I=
=20
> should start investigating this would be great.
>=20
> The general aim with Debian SE Linux is that you can run the policy with =
the=20
> kernel from the previous version of Debian.  So this is something I reall=
y=20
> want to fix.

If its the nnp transition polcap then you have some options:

1. easiest is to remove the references to "NoNewPrivileges=3D" in systemd s=
ervice units. Hopefully in these old versions of systemd this directive is =
not implied by other widely used directives.
I recall that back then I got away with this solution, at least untill the =
polcap was introduced.

2. hard and ugly: before the polcap was introduced, NNP was covered with ty=
pe bounds. (see selinux_err messages on older kernels)
This can get ugly really fast though as the NNP flag is inherited. Probably=
 best to avoid this option, but in theory it is possible to address this is=
sue with type bounds.

>=20
> --=20
> My Main Blog         http://etbe.coker.com.au/
> My Documents Blog    http://doc.coker.com.au/
>=20

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--/04w6evG8XlLl3ft
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlx9L1IACgkQJXSOVTf5
R2kENgv/V+avduhH1yFphIdXDMrmCHBnxmrsGnrfJWMNH5j7R5xIz96emKV8cBgt
I+ML9lsX0jzhKGsIR1PVV5oNmR2KLNclW38U805iPyrkdGluoAqjJNd4yI0sLYZJ
o0m1+yZ3CJG/uRfN/shs4AxOCy+VEi0vksM6/N+uW4D1oJYCo1E9CE6lWsAFOZJy
1ORXJ/qtiuw7SgCAVRQgG19r53EGKAg/2XsPIBZWSdZwl3IXbuYLbNSeXBxn6toD
aVy7jLtG4vADS1wgTxUTzzVjCtCqmw7/Rv9+vVARhu/LCKQicWsiO49iXaVT0lwa
Q2oU304vfq/olZbYAEU75Fz1SV5Tisg/dhf1ldpRdnOqXSj2CyqJ8msuXgAsHYmf
RNcIMKVq2sFAz5kYPXAg1G5e1D4i3if9ZeUQpOOWOzXOFYrd0bXfhe4LYXzAwGBi
q/+gnoW3XpClgUm0gsZ8Sm9UDnEmnenQLrPOT2JbJcm1QIckN4NqiC4UIHp70OIe
X3k2TzVm
=MvEt
-----END PGP SIGNATURE-----

--/04w6evG8XlLl3ft--