Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sat, 29 Jun 2019 15:12:43 +0200
From:   Dominick Grift <dac.override@gmail.com>
To:     Alexander Miroshnichenko <alex@millerson.name>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] Add support for openrc-init
Message-ID: <20190629131243.GA18602@brutus.lan>
Mail-Followup-To: Alexander Miroshnichenko <alex@millerson.name>,
        selinux-refpolicy@vger.kernel.org
References: <20190629123358.18284-1-alex@millerson.name>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="45Z9DzgjV8m4Oswq"
Content-Disposition: inline
In-Reply-To: <20190629123358.18284-1-alex@millerson.name>
User-Agent: Every email client sucks, this one just sucks less.
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk


--45Z9DzgjV8m4Oswq
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Jun 29, 2019 at 03:33:58PM +0300, Alexander Miroshnichenko wrote:
> Signed-off-by: Alexander Miroshnichenko <alex@millerson.name>
> ---
>  policy/modules/admin/shutdown.fc |  2 ++
>  policy/modules/admin/shutdown.te |  2 ++
>  policy/modules/system/init.fc    |  2 ++
>  policy/modules/system/init.if    | 18 ++++++++++++++++++
>  policy/modules/system/init.te    |  2 ++
>  5 files changed, 26 insertions(+)
>=20

Some observations:

What maintains (creates) /run/openrc, and why is it labeled initrc_state_t?=
 There is no FC spec for it (there should be a FC spec for /run/openrc).
Why is /run/openrc not labeled init_var_run_t?

The init_search_state_data() interface you created is redundant and its nam=
e is misleading (it would have been init_search_script_state())
However access to 'initctl' can be provided via init_rw_initctl(), and init=
_telinit() should call init_rw_initctl(). Then "shutdown" will be able to a=
ccess it automatically.
init_getattr_initctl() and init_write_initctl() should also be updated to a=
llow traversal of /run/openrc.

The period in the spec for /run/openrc/init.ctl should be escaped (/run/ope=
nrc/init\.ctl)

> diff --git a/policy/modules/admin/shutdown.fc b/policy/modules/admin/shut=
down.fc
> index 03a2230c6766..9d2e1b8acff2 100644
> --- a/policy/modules/admin/shutdown.fc
> +++ b/policy/modules/admin/shutdown.fc
> @@ -4,6 +4,8 @@
> =20
>  /usr/lib/upstart/shutdown	--	gen_context(system_u:object_r:shutdown_exec=
_t,s0)
> =20
> +/usr/sbin/openrc-shutdown	--	gen_context(system_u:object_r:shutdown_exec=
_t,s0)
> +
>  /usr/sbin/shutdown	--	gen_context(system_u:object_r:shutdown_exec_t,s0)
> =20
>  /run/shutdown\.pid	--	gen_context(system_u:object_r:shutdown_var_run_t,s=
0)
> diff --git a/policy/modules/admin/shutdown.te b/policy/modules/admin/shut=
down.te
> index 2168d03fcf63..c504fadb6dc9 100644
> --- a/policy/modules/admin/shutdown.te
> +++ b/policy/modules/admin/shutdown.te
> @@ -52,6 +52,8 @@ auth_use_nsswitch(shutdown_t)
>  auth_write_login_records(shutdown_t)
> =20
>  init_rw_utmp(shutdown_t)
> +# Search for init.ctl in /run/openrc by openrc-shutdown
> +init_search_state_data(shutdown_t)
>  init_stream_connect(shutdown_t)
>  init_telinit(shutdown_t)
> =20
> diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
> index 11a6ce93a040..48c78b8c6241 100644
> --- a/policy/modules/system/init.fc
> +++ b/policy/modules/system/init.fc
> @@ -41,6 +41,7 @@ ifdef(`distro_gentoo',`
> =20
>  /usr/sbin/init(ng)?	--	gen_context(system_u:object_r:init_exec_t,s0)
>  /usr/sbin/open_init_pty	--	gen_context(system_u:object_r:initrc_exec_t,s=
0)
> +/usr/sbin/openrc-init   --      gen_context(system_u:object_r:init_exec_=
t,s0)
>  /usr/sbin/upstart	--	gen_context(system_u:object_r:init_exec_t,s0)
> =20
>  ifdef(`distro_gentoo', `
> @@ -60,6 +61,7 @@ ifdef(`distro_redhat',`
>  /run/initctl	-p	gen_context(system_u:object_r:initctl_t,s0)
>  /run/kerneloops\.pid	--	gen_context(system_u:object_r:initrc_var_run_t,s=
0)
>  /run/utmp		--	gen_context(system_u:object_r:initrc_var_run_t,s0)
> +/run/openrc/init.ctl	-p	gen_context(system_u:object_r:initctl_t,s0)
>  /run/runlevel\.dir		gen_context(system_u:object_r:initrc_var_run_t,s0)
>  /run/random-seed	--	gen_context(system_u:object_r:initrc_var_run_t,s0)
>  /run/setmixer_flag	--	gen_context(system_u:object_r:initrc_var_run_t,s0)
> diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
> index 2415bb771080..2a7262b325a6 100644
> --- a/policy/modules/system/init.if
> +++ b/policy/modules/system/init.if
> @@ -1870,6 +1870,24 @@ interface(`init_startstop_all_script_services',`
>  	allow $1 init_script_file_type:service { start status stop };
>  ')
> =20
> +########################################
> +## <summary>
> +##      Search in a initrc_state_t directory.
> +## </summary>
> +## <param name=3D"domain">
> +##      <summary>
> +##      Domain allowed access.
> +##      </summary>
> +## </param>
> +#
> +interface(`init_search_state_data',`
> +        gen_require(`
> +                type initrc_state_t;
> +        ')
> +
> +	allow $1 initrc_state_t:dir search_dir_perms;
> +')
> +
>  ########################################
>  ## <summary>
>  ##	Read the process state (/proc/pid) of init.
> diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
> index f4d27bff3ea2..cb0f5f03d946 100644
> --- a/policy/modules/system/init.te
> +++ b/policy/modules/system/init.te
> @@ -146,6 +146,8 @@ allow init_t init_var_run_t:file manage_lnk_file_perm=
s;
>  allow init_t initctl_t:fifo_file manage_fifo_file_perms;
>  dev_filetrans(init_t, initctl_t, fifo_file)
>  files_pid_filetrans(init_t, initctl_t, fifo_file)
> +# Allow openrc-init to create /run/openrc/init.ctl pipe.
> +filetrans_add_pattern(init_t, initrc_state_t, initctl_t, fifo_file, "ini=
t.ctl" )
> =20
>  # Modify utmp.
>  allow init_t initrc_var_run_t:file { rw_file_perms setattr };
> --=20
> 2.21.0
>=20

--=20
Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02
https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02
Dominick Grift

--45Z9DzgjV8m4Oswq
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAl0XY8cACgkQJXSOVTf5
R2l/Hwv/dJz03BzUbieSPOqE5Vc/tQuduDFq/SVIIgl3TVgdc52ZCxlYR15ZAKw1
AcA8f1EkEPX/Q2DsCAojQm8FvFj5V84iWcZ+J6cOGCLNbd4SLnVyb85dt6m7gNIU
hYQiLC+i8ATr0hxIE2Pe8iurlhrwAHJrAHTPCEkgWpQGPYSuKGmUb7+s/D17j6Wk
bS+ZrOlWI8X/6vJ0scN5NH9XccHqGoMZMc3R7J7luJIN+cvZ5PRT40wXsTEZkWGg
A4zp3LqwXKphvpn7ekV9Y1Nn9DlRjN4Sxcawxc7ZeqaX1W+QQ6B6OMgC9qadV76V
fu7ZTZ14YWTSyQs2/FN9nsWkBixEaW0murvdUYMHIjW9w6pRbZB5H11Gv7+eoDZd
8bCWYAZwcmpvU3iP/OD0MEJuALeB//3ocpU1EjGt7mFAbncUaq1ydX77ZkkAqxx2
v3evIB32HxHb2AToVMfg5sGYhofxCkG7Ecgh5VC8Xm9kf6yhlhj2KmUkFd+4BjI7
IPso8jLL
=Fp1+
-----END PGP SIGNATURE-----

--45Z9DzgjV8m4Oswq--