Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] strict policy patches
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
References: <YWFpTPHEZiydqBOq@xev.coker.com.au>
From:   Daniel Burgener <dburgener@linux.microsoft.com>
Message-ID: <a0ff06f4-4fd2-376c-e749-fbcf2677218c@linux.microsoft.com>
Date:   Mon, 11 Oct 2021 12:12:42 -0400
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101
 Thunderbird/68.12.1
MIME-Version: 1.0
In-Reply-To: <YWFpTPHEZiydqBOq@xev.coker.com.au>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk


> ===================================================================
> --- refpolicy-2.20210908.orig/policy/modules/system/systemd.te
> +++ refpolicy-2.20210908/policy/modules/system/systemd.te
> @@ -65,10 +65,6 @@ type systemd_activate_t;
>   type systemd_activate_exec_t;
>   init_system_domain(systemd_activate_t, systemd_activate_exec_t)
>   
> -type systemd_analyze_t;
> -type systemd_analyze_exec_t;
> -init_daemon_domain(systemd_analyze_t, systemd_analyze_exec_t)
> -
>   type systemd_backlight_t;
>   type systemd_backlight_exec_t;
>   init_system_domain(systemd_backlight_t, systemd_backlight_exec_t)

I proposed a similar change last year here and the consensus in the PR 
discussion was that it would make more sense to add policy for the 
systemd_analyze_t domain for cases that wanted a transition there, but 
keeping the general approach of running in the parent domain.

https://github.com/SELinuxProject/refpolicy/pull/321

Of course, no one has actually submitted systemd_analyze_t policy yet, 
so maybe the demand for such a use case isn't all that high?

-Daniel