From: gizmo@giz-works.com (Chris Richards) Date: Sun, 28 Nov 2010 02:44:05 -0600 Subject: [refpolicy] [PATCH 1/2] Fix OpenRC status dir labeling for Gentoo Message-ID: <1290933845-9118-1-git-send-email-gizmo@giz-works.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Current policy sets /lib(32|64)?/rc/init.d to lib_t. This causes problems for DHCP among other things, as the initrc domain does not have permissions to perform some operations. Changing to initrc_state_t (the labeling used for /var/lib/init.d by the older baselayout-1) resolves some of these issues. Signed-off-by: Chris Richards --- policy/modules/system/init.fc | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc index 9775375..d79f336 100644 --- a/policy/modules/system/init.fc +++ b/policy/modules/system/init.fc @@ -66,3 +66,11 @@ ifdef(`distro_suse', ` /var/run/sysconfig(/.*)? gen_context(system_u:object_r:initrc_var_run_t,s0) ') +# +# /lib +# +ifdef(`distro_gentoo', ` +/lib/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0) +/lib32/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0) +/lib64/rc/init\.d(/.*)? gen_context(system_u:object_r:initrc_state_t,s0) +') -- 1.7.3.2