Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Dominick Grift <dominick.grift@defensec.nl>
To:     Daniel Burgener <dburgener@linux.microsoft.com>
Cc:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH] strict policy patches
References: <YWFpTPHEZiydqBOq@xev.coker.com.au>
        <a0ff06f4-4fd2-376c-e749-fbcf2677218c@linux.microsoft.com>
Date:   Mon, 11 Oct 2021 18:32:13 +0200
In-Reply-To: <a0ff06f4-4fd2-376c-e749-fbcf2677218c@linux.microsoft.com>
        (Daniel Burgener's message of "Mon, 11 Oct 2021 12:12:42 -0400")
Message-ID: <871r4rplo2.fsf@defensec.nl>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

Daniel Burgener <dburgener@linux.microsoft.com> writes:

>> ===================================================================
>> --- refpolicy-2.20210908.orig/policy/modules/system/systemd.te
>> +++ refpolicy-2.20210908/policy/modules/system/systemd.te
>> @@ -65,10 +65,6 @@ type systemd_activate_t;
>>   type systemd_activate_exec_t;
>>   init_system_domain(systemd_activate_t, systemd_activate_exec_t)
>>   -type systemd_analyze_t;
>> -type systemd_analyze_exec_t;
>> -init_daemon_domain(systemd_analyze_t, systemd_analyze_exec_t)
>> -
>>   type systemd_backlight_t;
>>   type systemd_backlight_exec_t;
>>   init_system_domain(systemd_backlight_t, systemd_backlight_exec_t)
>
> I proposed a similar change last year here and the consensus in the PR
> discussion was that it would make more sense to add policy for the 
> systemd_analyze_t domain for cases that wanted a transition there, but
> keeping the general approach of running in the parent domain.
>
> https://github.com/SELinuxProject/refpolicy/pull/321
>
> Of course, no one has actually submitted systemd_analyze_t policy yet,
> so maybe the demand for such a use case isn't all that high?
>
> -Daniel
>

I think I might have argued for keeping it around back then but I do not mind
removing it now. It certainly is not an init_daemon_domain(). One can
always add it later if needed.

-- 
gpg --locate-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift