Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.31 as permitted sender) client-ip=23.128.96.31;
Message-ID: <ed3adb7c-5a3a-4153-ae1d-d31bd4ccad9c@ieee.org>
Date:   Tue, 26 Sep 2023 14:38:16 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.14.0
Subject: Re: /usr/lib/NetworkManager/nm-dispatcher
To:     Russell Coker <russell@coker.com.au>,
        selinux-refpolicy@vger.kernel.org,
        Chris PeBenito <chpebeni@linux.microsoft.com>
References: <2772620.BEx9A2HvPv@cupcakke>
Content-Language: en-US
From:   Chris PeBenito <pebenito@ieee.org>
In-Reply-To: <2772620.BEx9A2HvPv@cupcakke>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 9/26/2023 4:09 AM, Russell Coker wrote:
> Regarding /usr/lib/NetworkManager/nm-dispatcher, you asked for more
> information when I submitted a patch changing the context.
> 
> Currently it has type NetworkManager_initrc_exec_t which implies that it's
> part of a start script when it's really a program that's doing the actual
> work.  Also that type means that when a laptop resumes from suspend it gets
> run in domain initrc_t which is not appropriate for it.
> 
> We could have a domain_auto_trans for type NetworkManager_initrc_exec_t but I
> think it's more appropriate to give it a label that more accurately reflects
> it's use.
> 
> What do you think Chris?

I agree that NetworkManager_initrc_exec_t doesn't fit.  It could warrant 
its own domain, like audisp, but I'm unsure without more info about the 
types of access it needs. i.e. more specific info than is in the man page.

-- 
Chris PeBenito