From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Wed, 27 May 2015 13:33:43 -0400
Subject: [refpolicy] [PATCH] Add openrc support to init_startstop_service
In-Reply-To: <CAPuKSJbq+Gm9QtnzhJprow1Wmrdh2JMOktSa641Ja58DX+zUMQ@mail.gmail.com>
References: <1432548165-19277-1-git-send-email-jason@perfinion.com>	<5565F552.2070007@tresys.com>
	<CAPuKSJbq+Gm9QtnzhJprow1Wmrdh2JMOktSa641Ja58DX+zUMQ@mail.gmail.com>
Message-ID: <5565FFF7.5090400@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 5/27/2015 1:22 PM, Jason Zaman wrote:
> 
> On 27 May 2015 20:48, "Christopher J. PeBenito" <cpebenito@tresys.com
> <mailto:cpebenito@tresys.com>> wrote:
>>
>> On 5/25/2015 6:02 AM, Jason Zaman wrote:
>> > Adds the openrc rules in ifdef distro_gentoo to transition
>> > to run_init correctly.
>>
>> I'm fine with this set except one note below.
>>
>> > ---
>> >  policy/modules/system/init.if        | 14 ++++---
>> >  policy/modules/system/selinuxutil.if | 75
> ++++++++++++++++++++++++++++++++++++
>> >  2 files changed, 84 insertions(+), 5 deletions(-)
>> >
>> > diff --git a/policy/modules/system/init.if
> b/policy/modules/system/init.if
>> > index f39437e..29c9955 100644
>> > --- a/policy/modules/system/init.if
>> > +++ b/policy/modules/system/init.if
>> > @@ -993,11 +993,15 @@ interface(`init_startstop_service',`
>> >       ')
>> >
>> >       ifndef(`direct_sysadm_daemon',`
>> > -             # rules for sysvinit / upstart
>> > -             init_labeled_script_domtrans($1, $4)
>> > -             domain_system_change_exemption($1)
>> > -             role_transition $2 $4 system_r;
>> > -             allow $2 system_r;
>> > +             ifdef(`distro_gentoo',`
>> > +                     seutil_spec_run_runinit($1, $2, $4)
>> > +             ',`
>> > +                     # rules for sysvinit / upstart
>> > +                     init_labeled_script_domtrans($1, $4)
>> > +                     domain_system_change_exemption($1)
>> > +                     role_transition $2 $4 system_r;
>> > +                     allow $2 system_r;
>> > +             ')
>> >       ')
>> >  ')
>> >
>> > diff --git a/policy/modules/system/selinuxutil.if
> b/policy/modules/system/selinuxutil.if
>> > index 129a6e0..e69f279 100644
>> > --- a/policy/modules/system/selinuxutil.if
>> > +++ b/policy/modules/system/selinuxutil.if
>> > @@ -379,6 +379,40 @@ interface(`seutil_domtrans_runinit',`
>> >
>> >  ########################################
>> >  ## <summary>
>> > +##   Execute file in the run_init domain.
>> > +## </summary>
>> > +## <desc>
>> > +##   <p>
>> > +##   Execute file in the run_init domain.
>> > +##   This is used for the Gentoo integrated run_init.
>> > +##   </p>
>> > +## </desc>
>> > +## <param name="domain">
>> > +##   <summary>
>> > +##   Domain allowed to transition.
>> > +##   </summary>
>> > +## </param>
>> > +## <param name="domain">
>> > +##   <summary>
>> > +##   Type of entry file.
>> > +##   </summary>
>> > +## </param>
>> > +#
>> > +interface(`seutil_spec_domtrans_runinit',`
>>
>> "spec" means setexeccon(), instead of type_transition, so this should
>> drop the "spec" from the name.  Same thing in the caller below.
>>
> 
> Oh, I always thought it meant specified.

That is what my intent was, except that I meant the parent domain
specified what the transition was via setexec.  Perhaps we should change
"spec" to "setexec" to make it clear.

> But I can't drop _spec because seutil_domtrans_runinit() already exists
> for plain initrc_exec_t.
> This new interface is basically one that can take the foo_initrc_exec_t
> as a param.
> 
> Suggestions? Seutil_prefixed_domtrans_runinit()?

It should probably be something like
seutil_labeled_init_script_domtrans_runinit(), but that's really long.
I'm not sure what to do to get that down to something reasonable.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com