Libcgroup moved cgclear to /sbin. Confine it so that initrc_t can domain transition to the cgclear_t domain. That way we do not have to extend the initrc_t domains policy. We might want to add cgroup_run_cgclear to sysadm module.

index c17388d..420c9d3 100644
@@ -1,10 +1,14 @@
 /etc/cgconfig.conf		--	gen_context(system_u:object_r:cgconfig_etc_t,s0)
 /etc/cgrules.conf		--	gen_context(system_u:object_r:cgrules_etc_t,s0)
 
+/etc/sysconfig/cgconfig		--	gen_context(system_u:object_r:cgconfig_etc_t,s0)
+/etc/sysconfig/cgred.conf	--	gen_context(system_u:object_r:cgrules_etc_t,s0)
+
 /etc/rc\.d/init\.d/cgconfig	--	gen_context(system_u:object_r:cgconfig_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/cgred	--	gen_context(system_u:object_r:cgred_initrc_exec_t,s0)
 
 /sbin/cgconfigparser		--	gen_context(system_u:object_r:cgconfig_exec_t,s0)
 /sbin/cgrulesengd		--	gen_context(system_u:object_r:cgred_exec_t,s0)
+/sbin/cgclear			--	gen_context(system_u:object_r:cgclear_exec_t,s0)
 
 /var/run/cgred.*			gen_context(system_u:object_r:cgred_var_run_t,s0)

103 lines not on this page · raw message

index bb3a671..121b137 100644
@@ -5,6 +5,10 @@ policy_module(cgroup, 1.0.0)
 # Declarations
 #
 
+type cgclear_t;
+type cgclear_exec_t;
+init_daemon_domain(cgclear_t, cgclear_exec_t)
+
 type cgred_t;
 type cgred_exec_t;
 init_daemon_domain(cgred_t, cgred_exec_t)

@@ -30,6 +34,22 @@ files_config_file(cgconfig_etc_t)
 
 ########################################
 #
+# cgcreate personal policy.
+#
+
+allow cgclear_t self:capability sys_admin;
+
+kernel_read_system_state(cgclear_t)
+
+domain_setpriority_all_domains(cgclear_t)
+
+fs_delete_cgroup_dirs(cgclear_t)
+fs_list_cgroup_dirs(cgclear_t)
+fs_rw_cgroup_files(cgclear_t)
+fs_unmount_cgroup(cgclear_t)
+
+########################################
+#
 # cgconfig personal policy.
 #
 

@@ -37,38 +57,46 @@ allow cgconfig_t self:capability { chown sys_admin };
 
 allow cgconfig_t cgconfig_etc_t:file read_file_perms;
 
+# search will do.
 kernel_list_unlabeled(cgconfig_t)
 kernel_read_system_state(cgconfig_t)
 
+# /etc/nsswitch.conf, /etc/passwd
 files_read_etc_files(cgconfig_t)
 
 fs_manage_cgroup_dirs(cgconfig_t)
 fs_manage_cgroup_files(cgconfig_t)
 fs_mount_cgroup(cgconfig_t)
 fs_mounton_cgroup(cgconfig_t)
-fs_unmount_cgroup(cgconfig_t)
 
 ########################################
 #
 # cgred personal policy.
 #
 
-allow cgred_t self:capability { net_admin sys_ptrace dac_override };
+# not sure about sys_admin
+allow cgred_t self:capability { net_admin sys_admin sys_ptrace dac_override };
 allow cgred_t self:netlink_socket { write bind create read };
 allow cgred_t self:unix_dgram_socket { write create connect };
 
 allow cgred_t cgrules_etc_t:file read_file_perms;
 
+# rc script creates pid file 
+manage_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
 manage_sock_files_pattern(cgred_t, cgred_var_run_t, cgred_var_run_t)
-files_pid_filetrans(cgred_t, cgred_var_run_t, sock_file)
+files_pid_filetrans(cgred_t, cgred_var_run_t, { file sock_file })
 
 kernel_read_system_state(cgred_t)
 
 domain_read_all_domains_state(cgred_t)
+# not sure about this but seems likely
+domain_setpriority_all_domains(cgred_t)
 
 files_getattr_all_files(cgred_t)
 files_getattr_all_sockets(cgred_t)
 files_read_all_symlinks(cgred_t)
+
+# /etc/group
 files_read_etc_files(cgred_t)
 
 fs_write_cgroup_files(cgred_t)

index 29f9757..d0d30e2 100644
@@ -338,9 +338,7 @@ files_mounton_isid_type_dirs(initrc_t)
 files_list_default(initrc_t)
 files_mounton_default(initrc_t)
 
-fs_delete_cgroup_dirs(initrc_t)
-fs_list_cgroup_dirs(initrc_t)
-fs_rw_cgroup_files(initrc_t)
+fs_write_cgroup_files(initrc_t)
 fs_list_inotifyfs(initrc_t)
 fs_register_binary_executable_type(initrc_t)
 # rhgb-console writes to ramfs

@@ -570,7 +568,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	cgroup_stream_connect(initrc_t)
+	cgroup_stream_connect_gred(initrc_t)
 ')
 
 optional_policy(`