From: guido@trentalancia.com (Guido Trentalancia)
Date: Thu, 09 Aug 2012 13:44:51 +0200
Subject: [refpolicy] [PATCH]: clean up some useless duplicated file contexts
for the initrc base directory (was Re: [PATCH] Initial BIRD Internet
Routing Daemon policy)
In-Reply-To: <502266E3.8060003@tresys.com>
References: <1344415924-27382-1-git-send-email-dominick.grift@gmail.com>
<5022443F.2040601@trentalancia.com>
<1344426166.2306.31.camel@d30.localdomain>
<502266E3.8060003@tresys.com>
Message-ID: <5023A2B3.2070308@trentalancia.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com
Hello Christopher.
On 08/08/2012 15:17, Christopher J. PeBenito wrote:
> On 08/08/12 07:42, Dominick Grift wrote:
>> On Wed, 2012-08-08 at 12:49 +0200, Guido Trentalancia wrote:
>>> On 08/08/2012 10:52, Dominick Grift wrote:
>
>>>> --- /dev/null
>>>> +++ b/bird.fc
>>>> @@ -0,0 +1,11 @@
>>>> +/etc/bird\.conf -- gen_context(system_u:object_r:bird_etc_t,s0)
>>>> +
>>>> +/etc/default/bird -- gen_context(system_u:object_r:bird_etc_t,s0)
>>>> +
>>>> +/etc/rc\.d/init\.d/bird -- gen_context(system_u:object_r:bird_initrc_exec_t,s0)
>>>
>>> You might want to support init script locations for other distributions
>>> here, as in the oident module that you proposed to modify yesterday (I
>>> am going to modify the mcelog too for this purpose).
>>>
>>> Debian (but also Gentoo and many others) are currently using /etc/init\.d.
>>>
>>> The rest is unlikely to change, if it does, it's their business to
>>> modify the contexts, I think.
>>
>> You have a good point and i have been thinking abou this issue
>> obviously. I decided to go this way because existing init daemons also
>> only have the /etc/rc.d/init.d and not the /etc/init.d.
>>
>> Maybe a better solution is to just add:
>>
>> /etc/init.d /etc/rc.d/init.d
>>
>> to file_contexts.subs_dist
>
> Its not a bad idea. I'd take a patch that cleaned this up across the entire policy.
Here is a possible patch:
Maintenance patch to remove some ambiguity and disomogeneity introduced
by the file contexts for the init scripts. The standard location for such
files is assumed by the Reference Policy to be /etc/rc.d/init.d and
distributions can customize such location by using the
file_contexts.subs_dist
file appropriately.
- modify file contexts definitions for the hadoop contributed module;
- improve a comment for the timidity contributed module;
- clarify some comments in the init system interfaces.
Signed-off-by: Guido Trentalancia
## Create a file type used for init scripts. It can not be
## used in conjunction with init_script_domain(). These
-## script files are typically stored in the /etc/init.d directory.
+## script files are typically stored in either the /etc/init.d
+## or the /etc/rc.d/init.d directory (depending on the
+## specific distribution).
##
## Typically this is used to constrain what services an
@@ -21,6 +23,15 @@
## This also makes the type usable for files; thus an
## explicit call to files_type() is redundant.
##
+## A quick and convenient way of adapting the location of the
+## init scripts (and in general any other base directory) for
+## different distributions is to edit the run-time configuration
+## file file_contexts.subs_dist. This file is located under the
+## subdirectory config/ of the Reference Policy build tree and
+## it is then available after installation in the subdirectory
+## contexts/files/ of the installed policy.
+##
## The types will be made usable as a domain and file, making @@ -251,8 +262,9 @@ interface(`init_daemon_domain',` ## MLS/MCS range. Short running processes ## should use the init_ranged_system_domain() interface instead. ## Typically all long running processes started by an init -## script (usually in /etc/init.d) will need to use this -## interface if they need to run in a specific MLS/MCS range. +## script (usually in /etc/init.d or /etc/rc.d/init.d, depending +## on the distribution) will need to use this interface if +## they need to run in a specific MLS/MCS range. ##
#### The types will be made usable as a domain and file, making @@ -310,8 +322,8 @@ interface(`init_ranged_daemon_domain',` ## Long running processes, such as daemons/services ## should use the init_daemon_domain() interface instead. ## Typically all short running processes started by an init -## script (usually in /etc/init.d) will need to use this -## interface. +## script (usually in /etc/init.d or /etc/rc.d/init.d, depending on the +## distribution) will need to use this interface. ##
#### The types will be made usable as a domain and file, making @@ -369,8 +381,9 @@ interface(`init_system_domain',` ## Long running processes ## should use the init_ranged_system_domain() interface instead. ## Typically all short running processes started by an init -## script (usually in /etc/init.d) will need to use this -## interface if they need to run in a specific MLS/MCS range. +## script (usually in /etc/init.d or /etc/rc.d/init.d, depending +## on the distribution) will need to use this interface if they +## need to run in a specific MLS/MCS range. ##
#### The types will be made usable as a domain and file, making @@ -939,7 +952,8 @@ interface(`init_all_labeled_script_domtr ##
## Start and stop daemon programs directly ## in the traditional "/etc/init.d/daemon start" -## style, and do not require run_init. +## or "/etc/rc.d/init.d/daemon start" style, +## and do not require run_init. ##
## ##