Re: [gentoo-hardened] SELinux base policy r2 in hardened-dev overlay

[Radosław Smogura]

Sven Vermeulen <swift@g.o> Sunday 21 of August 2011 12:06:46
> On Sat, Aug 20, 2011 at 08:08:41PM -0500, Chris Richards wrote:
> > > Yet we will eventually need to support this, because otherwise we need
> > > to "open" the privileges on initrc_t towards all potential services.
> > > Not only does that require lots of work, it also brings in patches in
> > > our policy that
> > > upstream will never accept (and they're right not to accept it).
> >
> > Ok, I buy the argument.  Is this a shortcoming in the old bash init, or
> > is this a shortcoming in OpenRC?
> >
> > I'm starting to see a little more free time from my job and might be able
> > to tackle some things starting in a couple of weeks.
>
> I'm not sure. A quick check reveals that there is no such thing as
> domain-specific initrc_t subdomains. It seems that the subdomains are there
> to allow roles within SELinux to handle init scripts of one daemon but not
> the other (for instance, create an ldapadm_r which has ldap_admin() and as
> such is allowed to execute it properly, but doesn't have the same rights
> for postfix).
>
> Within Gentoo, we mark everything as initrc_exec_t, so the user needs just
> "one" privilege to handle services for all domains. I'd like to "fix" that,
> but still keep the integrated run_init support in-place. That'll require
> some more investigation here (since I don't understand how the integrated
> run_init is done).
>
> However, my initial assessment that we "otherwise" need to "open" up
> initrc_t stays in place (we just don't have a choice here). That initrc_t
> is a highly privileged domain is obvious from a first look at its .te file.
> So it looks as if we just need to add the proper optional_policy statements
> here.
>
> BTW, glad to hear you're seeing some free time in the near future ;-)
>
> Wkr,
> 	Sven Vermeulen

I'm not SeLinux guroo, but at eye glance it looks like init (runint) script
1. reads contexts/run_init_type (but I think this is done to password 
authentication)
2. then it reads and changes to contexts/initrc_context domain.

This is made in policycoreutils-extras/runscript_selinux.c. There are some 
comments about initrc_devpts_t.

Maybe changin 2. will be solution, instead of read contexts/initrc_context 
take context from target script?

Regards,
Radek.