From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Wed, 3 Dec 2014 10:12:08 -0500
Subject: [refpolicy] [PATCH v3] Update policy for selinux userspace
 moving the policy store to /var/lib/selinux
In-Reply-To: <1417618526-25480-1-git-send-email-slawrence@tresys.com>
References: <1417618526-25480-1-git-send-email-slawrence@tresys.com>
Message-ID: <547F2848.1030403@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 12/3/2014 9:55 AM, Steve Lawrence wrote:
> With the new userspace, the only files in /var/lib/selinux are selinux
> store related files, so label it and everything inside it as
> semanage_store_t. semanage_var_lib_t is completely removed and now
> aliases semanage_store_t for backwards compatibility. This differs from
> the v2 patch in that it adds back the ability to manage
> selinux_config_t, which is necessary to manage the old module store for
> things like migrating from the old to new store and backwards
> compatability.

Merged.


> Signed-off-by: Steve Lawrence <slawrence@tresys.com>
> ---
>  policy/modules/system/selinuxutil.fc | 5 ++++-
>  policy/modules/system/selinuxutil.if | 2 ++
>  policy/modules/system/selinuxutil.te | 8 +-------
>  3 files changed, 7 insertions(+), 8 deletions(-)
> 
> diff --git a/policy/modules/system/selinuxutil.fc b/policy/modules/system/selinuxutil.fc
> index ec19d63..7616b31 100644
> --- a/policy/modules/system/selinuxutil.fc
> +++ b/policy/modules/system/selinuxutil.fc
> @@ -41,11 +41,14 @@
>  /usr/sbin/setsebool		--	gen_context(system_u:object_r:semanage_exec_t,s0)
>  /usr/sbin/semanage		--	gen_context(system_u:object_r:semanage_exec_t,s0)
>  /usr/sbin/semodule		--	gen_context(system_u:object_r:semanage_exec_t,s0)
> +/usr/libexec/selinux/semanage_migrate_store		--	gen_context(system_u:object_r:semanage_exec_t,s0)
>  
>  #
>  # /var/lib
>  #
> -/var/lib/selinux(/.*)?			gen_context(system_u:object_r:semanage_var_lib_t,s0)
> +/var/lib/selinux(/.*)?			gen_context(system_u:object_r:semanage_store_t,s0)
> +/var/lib/selinux/[^/]+/semanage\.read\.LOCK -- gen_context(system_u:object_r:semanage_read_lock_t,s0)
> +/var/lib/selinux/[^/]+/semanage\.trans\.LOCK -- gen_context(system_u:object_r:semanage_trans_lock_t,s0)
>  
>  #
>  # /var/run
> diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if
> index bee06f4..129a6e0 100644
> --- a/policy/modules/system/selinuxutil.if
> +++ b/policy/modules/system/selinuxutil.if
> @@ -1041,7 +1041,9 @@ interface(`seutil_manage_module_store',`
>  	')
>  
>  	files_search_etc($1)
> +	files_search_var($1)
>  	manage_dirs_pattern($1, selinux_config_t, semanage_store_t)
> +	manage_dirs_pattern($1, semanage_store_t, semanage_store_t)
>  	manage_files_pattern($1, semanage_store_t, semanage_store_t)
>  	manage_lnk_files_pattern($1, semanage_store_t, semanage_store_t)
>  ')
> diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
> index c322a6f..43cf82d 100644
> --- a/policy/modules/system/selinuxutil.te
> +++ b/policy/modules/system/selinuxutil.te
> @@ -100,7 +100,7 @@ application_domain(semanage_t, semanage_exec_t)
>  domain_interactive_fd(semanage_t)
>  role semanage_roles types semanage_t;
>  
> -type semanage_store_t;
> +type semanage_store_t alias semanage_var_lib_t;
>  files_type(semanage_store_t)
>  
>  type semanage_read_lock_t;
> @@ -112,9 +112,6 @@ files_tmp_file(semanage_tmp_t)
>  type semanage_trans_lock_t;
>  files_type(semanage_trans_lock_t)
>  
> -type semanage_var_lib_t;
> -files_type(semanage_var_lib_t)
> -
>  type setfiles_t alias restorecon_t, can_relabelto_binary_policy;
>  type setfiles_exec_t alias restorecon_exec_t;
>  init_system_domain(setfiles_t, setfiles_exec_t)
> @@ -454,9 +451,6 @@ allow semanage_t semanage_tmp_t:dir manage_dir_perms;
>  allow semanage_t semanage_tmp_t:file manage_file_perms;
>  files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir })
>  
> -manage_dirs_pattern(semanage_t, semanage_var_lib_t, semanage_var_lib_t)
> -manage_files_pattern(semanage_t, semanage_var_lib_t, semanage_var_lib_t)
> -
>  kernel_read_system_state(semanage_t)
>  kernel_read_kernel_sysctls(semanage_t)
>  
> 


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com