Re: [gentoo-hardened] Custom SELinux Policy: exe won't transition to correct context...

[Chris PeBenito]

On Mon, 2008-02-25 at 17:36 -0500, Mike Edenfield wrote:
> I'm trying to write a policy module for WPA (mostly for practice), to
> get rid of the numerous denials generated by the socket usage.  I'm
> stuck trying to get the wpa_cli and wpa_supplicant processes to
> transition to the context I've defined for them, when launched out of
> init.  They are holding the initrc_t context, even though I'm pretty
> sure I have everything set up properly.

Sorry for the slow response, but I was having some problems with my g.o
email.  I don't see the transition from initrc_t to your domain.  You
want to use the init_daemon_domain() interface.

> # Basic wpa_t domain and entry point.
> type wpa_t;
> type wpa_exec_t;
>
> domain_type(wpa_t)
> domain_entry_file(wpa_t, wpa_exec_t)
[...]
> /sbin/wpa_supplicant -- gen_context(system_u:object_r:wpa_exec_t, s0)
> /bin/wpa_cli         -- gen_context(system_u:object_r:wpa_exec_t, s0)
> /bin/wpa_passphrase  -- gen_context(system_u:object_r:wpa_exec_t, s0)
[...]
> # ps axZ | grep wpa
> system_u:system_r:initrc_t       3929 ?        Ss     0:03
> /sbin/wpa_supplicant
> system_u:system_r:initrc_t       3940 ?        Ss     0:01 /bin/wpa_cli

-- 
Chris PeBenito
<pebenito@g.o>
Developer,
Hardened Gentoo Linux
 
Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xE6AF9243
Key fingerprint = B0E6 877A 883F A57A 8E6A  CB00 BC8E E42D E6AF 9243