Date:   Sat, 13 Apr 2019 09:51:44 +0200
From:   Dominick Grift <dac.override@gmail.com>
To:     Russell Coker <russell@coker.com.au>
Cc:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: Re: [PATCH 2/3] Changes to support plymouth working in enforcing
Message-ID: <20190413075144.GA5901@brutus.lan>
Mail-Followup-To: Russell Coker <russell@coker.com.au>,
        "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" <selinux-refpolicy@vger.kernel.org>
References: <20190412193917.23886-1-dsugar@tresys.com>
 <2123404.RoTncvGGnz@liv>
 <3a5203d1-da92-4549-9a71-0055691e92be@tresys.com>
 <10127256.WPnezCvjeA@xev>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="gKMricLos+KVdGMg"
Content-Disposition: inline
In-Reply-To: <10127256.WPnezCvjeA@xev>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--gKMricLos+KVdGMg
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Apr 13, 2019 at 02:24:45PM +1000, Russell Coker wrote:
> On Saturday, 13 April 2019 1:23:15 PM AEST Sugar, David wrote:
> > On 4/12/19 10:43 PM, Russell Coker wrote:
> >=20
> > > On Saturday, 13 April 2019 5:39:31 AM AEST Sugar, David wrote:
> > >=20
> > >> plymouth is started very early in the boot process.  Looks
> > >> like before the SELinux policy is loaded so plymouthd is
> > >> running as kernel_t rather than plymouthd_t.  Due to this
> > >> I needed to allow a few permissions on kernel_t to get
> > >> the system to boot.
> > >=20
> > >=20
> > > Could plymouth re-exec itself or do a dynamic domain transition to get
> > > the
> > > right domain?
> > >=20
> >=20
> >=20
> > I don't see a way in the plymouth.conf or other configuration file to=
=20
> > have plymouth re-exec.
>=20
> Probably need to hack the plymouth source.

Not sure if it is worth the trouble, plymouthd mainly runs in the initramfs.
There's a couple of left-overs when systemd loads policy but that is it AFA=
IK.

>=20
> --=20
> My Main Blog         http://etbe.coker.com.au/
> My Documents Blog    http://doc.coker.com.au/
>=20

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--gKMricLos+KVdGMg
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlyxlQwACgkQJXSOVTf5
R2kWmwwAnBm32By/Ua51JKrVxu3F1dweFI5hi+RVhoF8cR/e5yCyxMvH3Sls4FZk
W4oGizeVY7n1D1PLQNyrdR2HPk4H0MZy3MAWQwf0lolhDy/OORmBS6sM8j0PI+wo
M3FZql4XlREl94GLGyiMiZTQlG5cFA+axRm7SrLn/W0qT1T14jEKkqH6xD+v1PHE
8Wb5Tr6EkhNAQMNg6qteo9MCSX/ifvZZvOhw1nN4LxtMECW7yWgUtYlDyaDG85Qy
z6ZXBnppnYt7FYu0bDhgTMJdcTgqJ6kBFqT1WRTDyqXh20ao6oPC7wV/7qKXJJQA
AuWi0BtLVATvI6nK8XhIydwOBbywKtMIoVTluObOGmeHm4+1aXIoDH0detFjU8Q/
IEjV/1YWfOVLK6ZwyYcDWyfJQlqEY0WHTf96xXITN2WVU/ejMHCgtZDYHbch8KdV
fOsFzt+A3660PIObEwMWBbtES374qVFODUwwLzKdrt5+LPCc9B88cz/eMKkePRwi
TJ5OrBzM
=N1tc
-----END PGP SIGNATURE-----

--gKMricLos+KVdGMg--