From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Wed, 15 Dec 2010 14:51:20 -0500
Subject: [refpolicy] [PATCH 1/2] Fix OpenRC status dir labeling for
	Gentoo
In-Reply-To: <1290933845-9118-1-git-send-email-gizmo@giz-works.com>
References: <1290933845-9118-1-git-send-email-gizmo@giz-works.com>
Message-ID: <4D091C38.50008@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 11/28/10 03:44, Chris Richards wrote:
> Current policy sets /lib(32|64)?/rc/init.d to lib_t.  This causes
> problems for DHCP among other things, as the initrc domain does not
> have permissions to perform some operations.  Changing to
> initrc_state_t (the labeling used for /var/lib/init.d by
> the older baselayout-1) resolves some of these issues.

This pair is merged.

> Signed-off-by: Chris Richards <gizmo@giz-works.com>
> ---
>  policy/modules/system/init.fc |    8 ++++++++
>  1 files changed, 8 insertions(+), 0 deletions(-)
> 
> diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
> index 9775375..d79f336 100644
> --- a/policy/modules/system/init.fc
> +++ b/policy/modules/system/init.fc
> @@ -66,3 +66,11 @@ ifdef(`distro_suse', `
>  /var/run/sysconfig(/.*)?	gen_context(system_u:object_r:initrc_var_run_t,s0)
>  ')
>  
> +#
> +# /lib
> +#
> +ifdef(`distro_gentoo', `
> +/lib/rc/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
> +/lib32/rc/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
> +/lib64/rc/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
> +')


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com