Add several named transition for directories created in /var/run by initscripts

PATCH New Laurent Bigonville 2 participants 21 messages Dec 5, 2012 – Dec 9, 2012

lore

Share & tools

lore

Laurent Bigonville

author

2012-12-05 22:03 UTC #0 lore raw

PATCH 1/9 Add several named transition for directories created in /var/run by initscripts

From: Laurent Bigonville <[email protected]>

In Debian, /var/run is a tmpfs, this means that the initscripts must recreate the needed directories during boot and they must be able to transition to the correct context.

---
 cups.te    |    1 +
 nut.te     |    1 +
 pcscd.te   |    1 +
 rpcbind.te |    1 +
 xen.te     |    1 +
 5 files changed, 5 insertions(+)

cups.te +1 -0

index 069141c..c1d5b4b 100644
@@ -59,6 +59,7 @@ files_tmp_file(cupsd_tmp_t)
 
 type cupsd_var_run_t;
 files_pid_file(cupsd_var_run_t)
+init_daemon_run_dir(cupsd_var_run_t, "cups")
 mls_trusted_object(cupsd_var_run_t)
 
 type hplip_t;

nut.te +1 -0

index 81ee2c6..e525457 100644
@@ -27,6 +27,7 @@ init_script_file(nut_initrc_exec_t)
 
 type nut_var_run_t;
 files_pid_file(nut_var_run_t)
+init_daemon_run_dir(nut_var_run_t, "nut")
 
 ########################################
 #

pcscd.te +1 -0

index 802728d..4c85dd5 100644
@@ -14,6 +14,7 @@ init_script_file(pcscd_initrc_exec_t)
 
 type pcscd_var_run_t;
 files_pid_file(pcscd_var_run_t)
+init_daemon_run_dir(pcscd_var_run_t, "pcscd")
 
 ########################################
 #

rpcbind.te +1 -0

index 8337482..b00c730 100644
@@ -14,6 +14,7 @@ init_script_file(rpcbind_initrc_exec_t)
 
 type rpcbind_var_run_t;
 files_pid_file(rpcbind_var_run_t)
+init_daemon_run_dir(rpcbind_var_run_t, "rpcbind")
 
 type rpcbind_var_lib_t;
 files_type(rpcbind_var_lib_t)

xen.te +1 -0

index 1c9a2f0..0ad5e4d 100644
@@ -105,6 +105,7 @@ logging_log_file(xenstored_var_log_t)
 
 type xenstored_var_run_t;
 files_pid_file(xenstored_var_run_t)
+init_daemon_run_dir(xenstored_var_run_t, "xenstored")
 
 type xenconsoled_t;
 type xenconsoled_exec_t;

Signature · 1 line

1.7.10.4

Laurent Bigonville

author

2012-12-05 22:03 UTC #1 lore raw

PATCH 2/9 rpcbind.te: Add named file transition for pidfile created by initscript

From: Laurent Bigonville <[email protected]>

---
 rpcbind.te |    1 +
 1 file changed, 1 insertion(+)

rpcbind.te +1 -0

index b00c730..56145c9 100644
@@ -15,6 +15,7 @@ init_script_file(rpcbind_initrc_exec_t)
 type rpcbind_var_run_t;
 files_pid_file(rpcbind_var_run_t)
 init_daemon_run_dir(rpcbind_var_run_t, "rpcbind")
+init_daemon_run_file(rpcbind_var_run_t, "rpcbind.pid")
 
 type rpcbind_var_lib_t;
 files_type(rpcbind_var_lib_t)

Signature · 1 line

1.7.10.4

Laurent Bigonville

author

2012-12-05 22:03 UTC #2 lore raw

PATCH 3/9 Run packagekit under apt_t context on Debian distribution

In reply to Laurent Bigonville

From: Laurent Bigonville <[email protected]>

Properly label the daemon and the needed files and directories

Also allow the daemon to transition to its own context when started by the system dbus

---
 apt.fc |    3 +++
 apt.te |    4 ++++
 rpm.fc |    4 ++--
 3 files changed, 9 insertions(+), 2 deletions(-)

apt.fc +3 -0

index 93d315c..1fd6888 100644
@@ -2,7 +2,10 @@ ifndef(`distro_redhat',`
 /usr/bin/apt-get	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/apt-shell	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/aptitude	--	gen_context(system_u:object_r:apt_exec_t,s0)
+/usr/lib/packagekit/packagekitd	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/sbin/synaptic	--	gen_context(system_u:object_r:apt_exec_t,s0)
+/var/cache/PackageKit(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
+/var/lib/PackageKit(/.*)?	gen_context(system_u:object_r:apt_var_lib_t,s0)
 ')
 
 /var/cache/apt(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)

apt.te +4 -0

index 5ffc8b8..aaa43cc 100644
@@ -125,6 +125,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+        dbus_system_domain(apt_t, apt_exec_t)
+')
+
+optional_policy(`
 	dpkg_read_db(apt_t)
 	dpkg_domtrans(apt_t)
 	dpkg_lock_db(apt_t)

rpm.fc +2 -2

index e37a2d5..ebe91fc 100644
@@ -31,17 +31,17 @@ ifdef(`distro_redhat',`
 /usr/bin/apt-shell	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/bin/aptitude	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/sbin/synaptic	--	gen_context(system_u:object_r:rpm_exec_t,s0)
+/var/cache/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_cache_t,s0)
+/var/lib/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
 ')
 
 /usr/share/yumex/yumex-yum-backend	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/share/yumex/yum_childtask\.py	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 
 /var/cache/bcfg2(/.*)?	gen_context(system_u:object_r:rpm_var_cache_t,s0)
-/var/cache/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_cache_t,s0)
 /var/cache/yum(/.*)?	gen_context(system_u:object_r:rpm_var_cache_t,s0)
 
 /var/lib/alternatives(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
-/var/lib/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
 /var/lib/rpm(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
 /var/lib/YaST2(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
 /var/lib/yum(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)

Signature · 1 line

1.7.10.4

grift

2012-12-06 15:40 UTC #3 lore raw

PATCH 3/9 Run packagekit under apt_t context on Debian distribution

Quoted 6 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>
Properly label the daemon and the needed files and directories
Also allow the daemon to transition to its own context when started by the system dbus

This was merged, thanks

Quoted 60 lines

---
 apt.fc |    3 +++
 apt.te |    4 ++++
 rpm.fc |    4 ++--
 3 files changed, 9 insertions(+), 2 deletions(-)

apt.fc +3 -0

index 93d315c..1fd6888 100644
@@ -2,7 +2,10 @@ ifndef(`distro_redhat',`
 /usr/bin/apt-get	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/apt-shell	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/bin/aptitude	--	gen_context(system_u:object_r:apt_exec_t,s0)
+/usr/lib/packagekit/packagekitd	--	gen_context(system_u:object_r:apt_exec_t,s0)
 /usr/sbin/synaptic	--	gen_context(system_u:object_r:apt_exec_t,s0)
+/var/cache/PackageKit(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)
+/var/lib/PackageKit(/.*)?	gen_context(system_u:object_r:apt_var_lib_t,s0)
 ')
 
 /var/cache/apt(/.*)?	gen_context(system_u:object_r:apt_var_cache_t,s0)

apt.te +4 -0

index 5ffc8b8..aaa43cc 100644
@@ -125,6 +125,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+        dbus_system_domain(apt_t, apt_exec_t)
+')
+
+optional_policy(`
 	dpkg_read_db(apt_t)
 	dpkg_domtrans(apt_t)
 	dpkg_lock_db(apt_t)

rpm.fc +2 -2

index e37a2d5..ebe91fc 100644
@@ -31,17 +31,17 @@ ifdef(`distro_redhat',`
 /usr/bin/apt-shell	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/bin/aptitude	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/sbin/synaptic	--	gen_context(system_u:object_r:rpm_exec_t,s0)
+/var/cache/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_cache_t,s0)
+/var/lib/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
 ')
 
 /usr/share/yumex/yumex-yum-backend	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 /usr/share/yumex/yum_childtask\.py	--	gen_context(system_u:object_r:rpm_exec_t,s0)
 
 /var/cache/bcfg2(/.*)?	gen_context(system_u:object_r:rpm_var_cache_t,s0)
-/var/cache/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_cache_t,s0)
 /var/cache/yum(/.*)?	gen_context(system_u:object_r:rpm_var_cache_t,s0)
 
 /var/lib/alternatives(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
-/var/lib/PackageKit(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
 /var/lib/rpm(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
 /var/lib/YaST2(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)
 /var/lib/yum(/.*)?	gen_context(system_u:object_r:rpm_var_lib_t,s0)

Laurent Bigonville

author

2012-12-05 22:03 UTC #4 lore raw

PATCH 4/9 Add proper label for colord daemon in debian

In reply to Laurent Bigonville

From: Laurent Bigonville <[email protected]>

Colord daemons in debian are installed in /usr/lib/<triplet>/colord/

---
 colord.fc |    3 +++
 1 file changed, 3 insertions(+)

colord.fc +3 -0

index 534db54..c185ca9 100644
@@ -1,3 +1,6 @@
+/usr/lib/.*\-.*\-.*/colord/colord	--	gen_context(system_u:object_r:colord_exec_t,s0)
+/usr/lib/.*\-.*\-.*/colord/colord-sane	--	gen_context(system_u:object_r:colord_exec_t,s0)
+
 /usr/libexec/colord	--	gen_context(system_u:object_r:colord_exec_t,s0)
 /usr/libexec/colord-sane	--	gen_context(system_u:object_r:colord_exec_t,s0)

Signature · 1 line

1.7.10.4

Laurent Bigonville

author

2012-12-05 23:09 UTC #5 lore raw

PATCH v2 4/9 Add proper label for colord daemon in debian

From: Laurent Bigonville <[email protected]>

Colord daemons in debian are installed in /usr/lib/<triplet>/colord/

---
 colord.fc |    3 +++
 1 file changed, 3 insertions(+)

colord.fc +3 -0

index 534db54..717ea0b 100644
@@ -1,3 +1,6 @@
+/usr/lib/[^/]*/colord/colord	--	gen_context(system_u:object_r:colord_exec_t,s0)
+/usr/lib/[^/]*/colord/colord-sane	--	gen_context(system_u:object_r:colord_exec_t,s0)
+
 /usr/libexec/colord	--	gen_context(system_u:object_r:colord_exec_t,s0)
 /usr/libexec/colord-sane	--	gen_context(system_u:object_r:colord_exec_t,s0)

Signature · 1 line

1.7.10.4

grift

2012-12-06 15:41 UTC #6 lore raw

PATCH v2 4/9 Add proper label for colord daemon in debian

Quoted 3 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>
Colord daemons in debian are installed in /usr/lib/<triplet>/colord/

This was merged, thanks

Quoted 15 lines

---
 colord.fc |    3 +++
 1 file changed, 3 insertions(+)

colord.fc +3 -0

index 534db54..717ea0b 100644
@@ -1,3 +1,6 @@
+/usr/lib/[^/]*/colord/colord	--	gen_context(system_u:object_r:colord_exec_t,s0)
+/usr/lib/[^/]*/colord/colord-sane	--	gen_context(system_u:object_r:colord_exec_t,s0)
+
 /usr/libexec/colord	--	gen_context(system_u:object_r:colord_exec_t,s0)
 /usr/libexec/colord-sane	--	gen_context(system_u:object_r:colord_exec_t,s0)

Laurent Bigonville

author

2012-12-05 22:03 UTC #7 lore raw

PATCH 5/9 Allow the system dbus to search cgroup directories

In reply to Laurent Bigonville

From: Laurent Bigonville <[email protected]>

When compiling with systemd support, dbus is looking at the available cgroups to try to figure out if the system has booted using systemd

---
 dbus.te |    1 +
 1 file changed, 1 insertion(+)

dbus.te +1 -0

index 586c97f..b9d84e7 100644
@@ -101,6 +101,7 @@ files_read_usr_files(system_dbusd_t)
 fs_getattr_all_fs(system_dbusd_t)
 fs_list_inotifyfs(system_dbusd_t)
 fs_search_auto_mountpoints(system_dbusd_t)
+fs_search_cgroup_dirs(system_dbusd_t)
 fs_dontaudit_list_nfs(system_dbusd_t)
 
 mls_fd_use_all_levels(system_dbusd_t)

Signature · 1 line

1.7.10.4

grift

2012-12-06 15:42 UTC #8 lore raw

PATCH 5/9 Allow the system dbus to search cgroup directories

Quoted 4 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>
When compiling with systemd support, dbus is looking at the available cgroups to try to figure out if the system has booted using systemd

This was merged, thanks

Quoted 16 lines

---
 dbus.te |    1 +
 1 file changed, 1 insertion(+)

dbus.te +1 -0

index 586c97f..b9d84e7 100644
@@ -101,6 +101,7 @@ files_read_usr_files(system_dbusd_t)
 fs_getattr_all_fs(system_dbusd_t)
 fs_list_inotifyfs(system_dbusd_t)
 fs_search_auto_mountpoints(system_dbusd_t)
+fs_search_cgroup_dirs(system_dbusd_t)
 fs_dontaudit_list_nfs(system_dbusd_t)
 
 mls_fd_use_all_levels(system_dbusd_t)

Laurent Bigonville

author

2012-12-05 22:03 UTC #9 lore raw

PATCH 6/9 Ensure that consolekit can create /var/run/console directory on Debian

In reply to Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 consolekit.te |    5 +++++
 1 file changed, 5 insertions(+)

consolekit.te +5 -0

index 1ca336f..6cfaee6 100644
@@ -87,6 +87,11 @@ tunable_policy(`use_samba_home_dirs',`
 	fs_read_cifs_files(consolekit_t)
 ')
 
+ifdef(`distro_debian',`
+	auth_create_pam_console_data_dirs(consolekit_t)
+	auth_pid_filetrans_pam_var_console(consolekit_t, dir, "console")
+')
+
 optional_policy(`
 	dbus_system_domain(consolekit_t, consolekit_exec_t)

Signature · 1 line

1.7.10.4

grift

2012-12-05 22:13 UTC #10 lore raw

PATCH 6/9 Ensure that consolekit can create /var/run/console directory on Debian

Quoted 12 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 consolekit.te |    5 +++++
 1 file changed, 5 insertions(+)

consolekit.te +0 -0

index 1ca336f..6cfaee6 100644
@@ -87,6 +87,11 @@ tunable_policy(`use_samba_home_dirs',`
 	fs_read_cifs_files(consolekit_t)

consolekit.te tunable_policy(`use_samba_home_dirs',` · line 97

Quoted 10 lines

consolekit.te +5 -0

 ')
 
+ifdef(`distro_debian',`
+	auth_create_pam_console_data_dirs(consolekit_t)
+	auth_pid_filetrans_pam_var_console(consolekit_t, dir, "console")
+')
+
 optional_policy(`
 	dbus_system_domain(consolekit_t, consolekit_exec_t)

I will put this one in my "outstanding" folder since i need to wait for those interfaces to become available in refpolicy

grift

2012-12-09 13:14 UTC #11 lore raw

PATCH 6/9 Ensure that consolekit can create /var/run/console directory on Debian

In reply to Laurent Bigonville

Quoted 1 line · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

This was merged, thanks

Quoted 21 lines

---
 consolekit.te |    5 +++++
 1 file changed, 5 insertions(+)

consolekit.te +5 -0

index 1ca336f..6cfaee6 100644
@@ -87,6 +87,11 @@ tunable_policy(`use_samba_home_dirs',`
 	fs_read_cifs_files(consolekit_t)
 ')
 
+ifdef(`distro_debian',`
+	auth_create_pam_console_data_dirs(consolekit_t)
+	auth_pid_filetrans_pam_var_console(consolekit_t, dir, "console")
+')
+
 optional_policy(`
 	dbus_system_domain(consolekit_t, consolekit_exec_t)

Laurent Bigonville

author

2012-12-05 22:03 UTC #12 lore raw

PATCH 7/9 Allow virtd_t context to read sysctl_crypto_t

In reply to Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 virt.te |    1 +
 1 file changed, 1 insertion(+)

virt.te +1 -0

index 49c9f17..00676eb 100644
@@ -504,6 +504,7 @@ stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain)
 
 can_exec(virtd_t, virt_tmp_t)
 
+kernel_read_crypto_sysctls(virtd_t)
 kernel_read_system_state(virtd_t)
 kernel_read_network_state(virtd_t)
 kernel_rw_net_sysctls(virtd_t)

Signature · 1 line

1.7.10.4

grift

2012-12-06 15:44 UTC #13 lore raw

PATCH 7/9 Allow virtd_t context to read sysctl_crypto_t

Quoted 1 line · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

This was merged, thanks

Quoted 16 lines

---
 virt.te |    1 +
 1 file changed, 1 insertion(+)

virt.te +1 -0

index 49c9f17..00676eb 100644
@@ -504,6 +504,7 @@ stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain)
 
 can_exec(virtd_t, virt_tmp_t)
 
+kernel_read_crypto_sysctls(virtd_t)
 kernel_read_system_state(virtd_t)
 kernel_read_network_state(virtd_t)
 kernel_rw_net_sysctls(virtd_t)

Laurent Bigonville

author

2012-12-05 22:03 UTC #14 lore raw

PATCH 8/9 Allow colord_t context to read sysctl_crypto_t

In reply to Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 colord.te |    1 +
 1 file changed, 1 insertion(+)

colord.te +1 -0

index 189ef9e..2daf284 100644
@@ -43,6 +43,7 @@ manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
 manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
 files_var_lib_filetrans(colord_t, colord_var_lib_t, dir)
 
+kernel_read_crypto_sysctls(colord_t)
 kernel_read_device_sysctls(colord_t)
 kernel_read_network_state(colord_t)
 kernel_read_system_state(colord_t)

Signature · 1 line

1.7.10.4

grift

2012-12-06 15:45 UTC #15 lore raw

PATCH 8/9 Allow colord_t context to read sysctl_crypto_t

Quoted 1 line · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

This was merged, thanks

Quoted 17 lines

---
 colord.te |    1 +
 1 file changed, 1 insertion(+)

colord.te +1 -0

index 189ef9e..2daf284 100644
@@ -43,6 +43,7 @@ manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
 manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
 files_var_lib_filetrans(colord_t, colord_var_lib_t, dir)
 
+kernel_read_crypto_sysctls(colord_t)
 kernel_read_device_sysctls(colord_t)
 kernel_read_network_state(colord_t)
 kernel_read_system_state(colord_t)

Laurent Bigonville

author

2012-12-05 22:03 UTC #16 lore raw

PATCH 9/9 Add proper label for gconfd-2 daemon in Debian

In reply to Laurent Bigonville

From: Laurent Bigonville <[email protected]>

Gconfd-2 daemon in debian installed in /usr/lib/<triplet>/colord/

---
 gnome.fc |    1 +
 1 file changed, 1 insertion(+)

gnome.fc +1 -0

index b44275d..93596e2 100644
@@ -11,4 +11,5 @@ HOME_DIR/\.gnome2_private(/.*)?	gen_context(system_u:object_r:gnome_home_t,s0)
 
 /usr/bin/gnome-keyring-daemon	--	gen_context(system_u:object_r:gkeyringd_exec_t,s0)
 
+/usr/lib/.*\-.*\-.*/gconf/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)
 /usr/libexec/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)

Signature · 1 line

1.7.10.4

grift

2012-12-05 22:06 UTC #17 lore raw

PATCH 9/9 Add proper label for gconfd-2 daemon in Debian

Quoted 3 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>
Gconfd-2 daemon in debian installed in /usr/lib/<triplet>/colord/

colord?!

gnome.fc HOME_DIR/\.gnome2_private(/.*)? gen_context(system_u:object_r:gnome_home_t,s0) · line 14

Quoted 13 lines

---
 gnome.fc |    1 +
 1 file changed, 1 insertion(+)

gnome.fc +1 -0

index b44275d..93596e2 100644
@@ -11,4 +11,5 @@ HOME_DIR/\.gnome2_private(/.*)?	gen_context(system_u:object_r:gnome_home_t,s0)
 
 /usr/bin/gnome-keyring-daemon	--	gen_context(system_u:object_r:gkeyringd_exec_t,s0)
 
+/usr/lib/.*\-.*\-.*/gconf/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)

Is this the most optimal regular expression? It looks a bit unnatural

Quoted 1 line

gnome.fc +0 -0

 /usr/libexec/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)

Laurent Bigonville

author

2012-12-05 22:52 UTC #18 lore raw

PATCH v2 9/9 Add proper label for gconfd-2 daemon in Debian

From: Laurent Bigonville <[email protected]>

Gconfd-2 daemon in debian installed in /usr/lib/<triplet>/gconf/

---
 gnome.fc |    1 +
 1 file changed, 1 insertion(+)

gnome.fc +1 -0

index b44275d..e39de43 100644
@@ -11,4 +11,5 @@ HOME_DIR/\.gnome2_private(/.*)?	gen_context(system_u:object_r:gnome_home_t,s0)
 
 /usr/bin/gnome-keyring-daemon	--	gen_context(system_u:object_r:gkeyringd_exec_t,s0)
 
+/usr/lib/[^/]*/gconf/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)
 /usr/libexec/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)

Signature · 1 line

1.7.10.4

grift

2012-12-06 15:46 UTC #19 lore raw

PATCH v2 9/9 Add proper label for gconfd-2 daemon in Debian

Quoted 3 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>
Gconfd-2 daemon in debian installed in /usr/lib/<triplet>/gconf/

This was merged, thanks

Quoted 14 lines

---
 gnome.fc |    1 +
 1 file changed, 1 insertion(+)

gnome.fc +1 -0

index b44275d..e39de43 100644
@@ -11,4 +11,5 @@ HOME_DIR/\.gnome2_private(/.*)?	gen_context(system_u:object_r:gnome_home_t,s0)
 
 /usr/bin/gnome-keyring-daemon	--	gen_context(system_u:object_r:gkeyringd_exec_t,s0)
 
+/usr/lib/[^/]*/gconf/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)
 /usr/libexec/gconfd-2	--	gen_context(system_u:object_r:gconfd_exec_t,s0)

grift

2012-12-06 15:39 UTC #20 lore raw

PATCH 1/9 Add several named transition for directories created in /var/run by initscripts

In reply to Laurent Bigonville

Quoted 5 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>
In Debian, /var/run is a tmpfs, this means that the initscripts must recreate the needed directories during boot and they must be able to transition to the correct context.

This was merged, thanks

Quoted 68 lines

---
 cups.te    |    1 +
 nut.te     |    1 +
 pcscd.te   |    1 +
 rpcbind.te |    1 +
 xen.te     |    1 +
 5 files changed, 5 insertions(+)

cups.te +1 -0

index 069141c..c1d5b4b 100644
@@ -59,6 +59,7 @@ files_tmp_file(cupsd_tmp_t)
 
 type cupsd_var_run_t;
 files_pid_file(cupsd_var_run_t)
+init_daemon_run_dir(cupsd_var_run_t, "cups")
 mls_trusted_object(cupsd_var_run_t)
 
 type hplip_t;

nut.te +1 -0

index 81ee2c6..e525457 100644
@@ -27,6 +27,7 @@ init_script_file(nut_initrc_exec_t)
 
 type nut_var_run_t;
 files_pid_file(nut_var_run_t)
+init_daemon_run_dir(nut_var_run_t, "nut")
 
 ########################################
 #

pcscd.te +1 -0

index 802728d..4c85dd5 100644
@@ -14,6 +14,7 @@ init_script_file(pcscd_initrc_exec_t)
 
 type pcscd_var_run_t;
 files_pid_file(pcscd_var_run_t)
+init_daemon_run_dir(pcscd_var_run_t, "pcscd")
 
 ########################################
 #

rpcbind.te +1 -0

index 8337482..b00c730 100644
@@ -14,6 +14,7 @@ init_script_file(rpcbind_initrc_exec_t)
 
 type rpcbind_var_run_t;
 files_pid_file(rpcbind_var_run_t)
+init_daemon_run_dir(rpcbind_var_run_t, "rpcbind")
 
 type rpcbind_var_lib_t;
 files_type(rpcbind_var_lib_t)

xen.te +1 -0

index 1c9a2f0..0ad5e4d 100644
@@ -105,6 +105,7 @@ logging_log_file(xenstored_var_log_t)
 
 type xenstored_var_run_t;
 files_pid_file(xenstored_var_run_t)
+init_daemon_run_dir(xenstored_var_run_t, "xenstored")
 
 type xenconsoled_t;
 type xenconsoled_exec_t;