From: jason@perfinion.com (Jason Zaman)
Date: Wed, 27 May 2015 21:22:28 +0400
Subject: [refpolicy] [PATCH] Add openrc support to init_startstop_service
In-Reply-To: <5565F552.2070007@tresys.com>
References: <1432548165-19277-1-git-send-email-jason@perfinion.com>
	<5565F552.2070007@tresys.com>
Message-ID: <CAPuKSJbq+Gm9QtnzhJprow1Wmrdh2JMOktSa641Ja58DX+zUMQ@mail.gmail.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 27 May 2015 20:48, "Christopher J. PeBenito" <cpebenito@tresys.com>
wrote:
>
> On 5/25/2015 6:02 AM, Jason Zaman wrote:
> > Adds the openrc rules in ifdef distro_gentoo to transition
> > to run_init correctly.
>
> I'm fine with this set except one note below.
>
> > ---
> >  policy/modules/system/init.if        | 14 ++++---
> >  policy/modules/system/selinuxutil.if | 75
++++++++++++++++++++++++++++++++++++
> >  2 files changed, 84 insertions(+), 5 deletions(-)
> >
> > diff --git a/policy/modules/system/init.if
b/policy/modules/system/init.if
> > index f39437e..29c9955 100644
> > --- a/policy/modules/system/init.if
> > +++ b/policy/modules/system/init.if
> > @@ -993,11 +993,15 @@ interface(`init_startstop_service',`
> >       ')
> >
> >       ifndef(`direct_sysadm_daemon',`
> > -             # rules for sysvinit / upstart
> > -             init_labeled_script_domtrans($1, $4)
> > -             domain_system_change_exemption($1)
> > -             role_transition $2 $4 system_r;
> > -             allow $2 system_r;
> > +             ifdef(`distro_gentoo',`
> > +                     seutil_spec_run_runinit($1, $2, $4)
> > +             ',`
> > +                     # rules for sysvinit / upstart
> > +                     init_labeled_script_domtrans($1, $4)
> > +                     domain_system_change_exemption($1)
> > +                     role_transition $2 $4 system_r;
> > +                     allow $2 system_r;
> > +             ')
> >       ')
> >  ')
> >
> > diff --git a/policy/modules/system/selinuxutil.if
b/policy/modules/system/selinuxutil.if
> > index 129a6e0..e69f279 100644
> > --- a/policy/modules/system/selinuxutil.if
> > +++ b/policy/modules/system/selinuxutil.if
> > @@ -379,6 +379,40 @@ interface(`seutil_domtrans_runinit',`
> >
> >  ########################################
> >  ## <summary>
> > +##   Execute file in the run_init domain.
> > +## </summary>
> > +## <desc>
> > +##   <p>
> > +##   Execute file in the run_init domain.
> > +##   This is used for the Gentoo integrated run_init.
> > +##   </p>
> > +## </desc>
> > +## <param name="domain">
> > +##   <summary>
> > +##   Domain allowed to transition.
> > +##   </summary>
> > +## </param>
> > +## <param name="domain">
> > +##   <summary>
> > +##   Type of entry file.
> > +##   </summary>
> > +## </param>
> > +#
> > +interface(`seutil_spec_domtrans_runinit',`
>
> "spec" means setexeccon(), instead of type_transition, so this should
> drop the "spec" from the name.  Same thing in the caller below.
>

Oh, I always thought it meant specified.
But I can't drop _spec because seutil_domtrans_runinit() already exists for
plain initrc_exec_t.
This new interface is basically one that can take the foo_initrc_exec_t as
a param.

Suggestions? Seutil_prefixed_domtrans_runinit()?

>
> > +     gen_require(`
> > +             type run_init_t;
> > +     ')
> > +
> > +     domain_entry_file(run_init_t, $2)
> > +     domain_auto_transition_pattern($1, $2, run_init_t)
> > +
> > +     allow run_init_t $1:fd use;
> > +     allow run_init_t $1:fifo_file rw_file_perms;
> > +     allow run_init_t $1:process sigchld;
> > +')
> > +
> > +########################################
> > +## <summary>
> >  ##   Execute init scripts in the run_init domain.
> >  ## </summary>
> >  ## <desc>
> > @@ -470,6 +504,47 @@ interface(`seutil_init_script_run_runinit',`
> >
> >  ########################################
> >  ## <summary>
> > +##   Execute specified file in the run_init domain, and
> > +##   allow the specified role the run_init domain,
> > +##   and use the caller's terminal.
> > +## </summary>
> > +## <desc>
> > +##   <p>
> > +##   Execute specified file in the run_init domain, and
> > +##   allow the specified role the run_init domain,
> > +##   and use the caller's terminal.
> > +##   </p>
> > +##   <p>
> > +##   This is used for the Gentoo integrated run_init.
> > +##   </p>
> > +## </desc>
> > +## <param name="domain">
> > +##   <summary>
> > +##   Domain allowed to transition.
> > +##   </summary>
> > +## </param>
> > +## <param name="role">
> > +##   <summary>
> > +##   Role allowed access.
> > +##   </summary>
> > +## </param>
> > +## <param name="domain">
> > +##   <summary>
> > +##   Type of init script.
> > +##   </summary>
> > +## </param>
> > +#
> > +interface(`seutil_spec_run_runinit',`
> > +     gen_require(`
> > +             attribute_role run_init_roles;
> > +     ')
> > +
> > +     seutil_spec_domtrans_runinit($1, $3)
> > +     roleattribute $2 run_init_roles;
> > +')
> > +
> > +########################################
> > +## <summary>
> >  ##   Inherit and use run_init file descriptors.
> >  ## </summary>
> >  ## <param name="domain">
> >
>
>
> --
> Chris PeBenito
> Tresys Technology, LLC
> www.tresys.com | oss.tresys.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20150527/76ea03d0/attachment-0001.html