Current policy sets /lib(32|64)?/rc/init.d to lib_t. This causes
problems for DHCP among other things, as the initrc domain does not
have permissions to perform some operations. Changing to
initrc_state_t (the labeling used for /var/lib/init.d by
the older baselayout-1) resolves some of these issues.
Signed-off-by: Chris Richards <[email protected]>
---
policy/modules/system/init.fc | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index 9775375..d79f336 100644
--- a/policy/modules/system/init.fc
+++ b/policy/modules/system/init.fc
@@ -66,3 +66,11 @@ ifdef(`distro_suse', `
/var/run/sysconfig(/.*)? gen_context(system_u:object_r:initrc_var_run_t,s0)
')
+#
+# /lib
+#
+ifdef(`distro_gentoo', `
+/lib/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
+/lib32/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
+/lib64/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
+')
--
1.7.3.2
On 11/28/10 03:44, Chris Richards wrote:
> Current policy sets /lib(32|64)?/rc/init.d to lib_t. This causes
> problems for DHCP among other things, as the initrc domain does not
> have permissions to perform some operations. Changing to
> initrc_state_t (the labeling used for /var/lib/init.d by
> the older baselayout-1) resolves some of these issues.
This pair is merged.
> Signed-off-by: Chris Richards <[email protected]>
> ---
> policy/modules/system/init.fc | 8 ++++++++
> 1 files changed, 8 insertions(+), 0 deletions(-)
>
> diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
> index 9775375..d79f336 100644
> --- a/policy/modules/system/init.fc
> +++ b/policy/modules/system/init.fc
> @@ -66,3 +66,11 @@ ifdef(`distro_suse', `
> /var/run/sysconfig(/.*)? gen_context(system_u:object_r:initrc_var_run_t,s0)
> ')
>
> +#
> +# /lib
> +#
> +ifdef(`distro_gentoo', `
> +/lib/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
> +/lib32/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
> +/lib64/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0)
> +')
--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com