From: dwalsh@redhat.com (Daniel J Walsh)
Date: Tue, 13 May 2014 09:55:12 -0400
Subject: [refpolicy] [PATCH] Make unconfined user run lvm programs in
 confined domain
In-Reply-To: <53721414.508@tresys.com>
References: <1399733124-10693-1-git-send-email-nicolas.iooss@m4x.org>
	<53721414.508@tresys.com>
Message-ID: <53722440.7070000@redhat.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com


On 05/13/2014 08:46 AM, Christopher J. PeBenito wrote:
> On 05/10/2014 10:45 AM, Nicolas Iooss wrote:
>> When an unconfined user uses truecrypt to mount an encrypted file, dmsetup is
>> called to setup a new device.  This program works with udev to configure the
>> new device and uses SysV semaphores to synchronize states.  As udev runs
>> dmsetup in lvm_t domain, the first dmsetup process needs to create lvm_t
>> semaphores (not unconfined_t) and hence needs to run in lvm_t domain.
>>
>> More details are available in the archives on the ML:
>> http://oss.tresys.com/pipermail/refpolicy/2014-May/007111.html
>> ---
>>  policy/modules/system/unconfined.te | 4 ++++
>>  1 file changed, 4 insertions(+)
>>
>> diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
>> index 472a39e..79f2909 100644
>> --- a/policy/modules/system/unconfined.te
>> +++ b/policy/modules/system/unconfined.te
>> @@ -108,6 +108,10 @@ optional_policy(`
>>  ')
>>  
>>  optional_policy(`
>> +	lvm_run(unconfined_t, unconfined_r)
>> +')
>> +
>> +optional_policy(`
>>  	modutils_run_update_mods(unconfined_t, unconfined_r)
>>  ')
> Merged.
>
Why would we add a confinement to the unconfined domain?  I believe
unconfined_t should stay unconfined as much as possible.

I wrote a blog about this.

https://danwalsh.livejournal.com/30084.html

The only reason to do this in the past was for correct labeling, but
with file name transition rules, I believe almost all transitions from
unconfined_t should be eliminated.