Re: [gentoo-hardened] SELinux base policy r2 in hardened-dev overlay

[Sven Vermeulen]

On Sun, Aug 21, 2011 at 07:19:17PM -0400, Mike Edenfield wrote:
>> The solution to support<domain>_initrc_exec_t must be a policy-based one
>> afaik. I don't think it'll be too difficult to find (the places within
>> refpolicy that are offering interfaces just for Gentoo's integrated
>> run_init
>> are documented), it'll just take some time to get it in proper shape.
>
> Is there a specific reason that the domain-specific initrc support cannot
> be made part of run_init? Instead of reading a single default context from
> initrc_context, you could instead label, for ex. the init script itself,
> and have run_init use that instead?

The run_init application is merely a tool to support transitions across
roles as well. Its behavior can well be defined by the SELinux policy
itself.

What you are suggesting (label init script) is exactly what I was talking
about: instead of having the init scripts labeled initrc_exec_t, they should
be labeled like slapd_initrc_exec_t, postfix_initrc_exec_t, ... and Gentoo's
integrated run_init support, which by the policy is currently only working
on initrc_exec_t, should support those too.

Since the policy defines an attribute called init_script_file_type, I hope
to update the Gentoo-specific privileges towards this attribute rather than
to initrc_exec_t so that the current behavior (sysadm_r can call init
scripts directly) is retained.

Then the second approach is to update - I think - the init_script_file
interface to support the Gentoo integrated run_init as well. But that's
something to test and find out.

Wkr,
	Sven Vermeulen