From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Sat, 8 Dec 2012 22:18:07 +0100 Subject: [refpolicy] Kernel-triggered scripts Message-ID: <20121208211807.GA7476@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Hi guys, One of the init systems that Gentoo supports uses kernel-triggered scripts for managing cgroups (I'm pretty sure others do a similar thing). If the script is labeled as bin_t, the execution of the script runs as kernel_t. I'd like to set up a proper domain transition for this, but I'm not sure where to position it exactly. It is part of the init system, but it has little to do with "init" by itself, so I'm inclined to put it in either a separate module, or inside the portage module. What do other distributions do with kernel-triggered scripts? Let them run in the kernel_t domain? The domain runs as unconfined if you support unconfined domains, so it is possible most distributions have less impact on such things). Wkr, Sven Vermeulen