Adding support for dracut

While trying to get a SELinux-supporting initramfs booted up (in enforcing mode, without unconfined domains) my current attempts are at dracut. But dracut itself didn't work quite well on such a system as running it in sysadm_t domain fails (some domain transitions occur which are then asked to write files in user_tmp_t which isn't allowed for those domains).

Instead of patching those domains (ldconfig_t and depmod_t) to allow writing & creating files in user_tmp_t (i.e. manage privileges) I drafted up a dracut domain (dracut_t) and grant those domains manage access to dracut_tmp_t.

To support dracut, a few changes were necessary to the policy as well (additional interfaces).

The summary:
- Add read interface for udev rules (udev_read_rules_files)
- List module configuration option files (modutils_list_module_config)
- Add in the dracut_t policy
- Grant ldconfig_t and depmod_t the dracut_manage_tmp_files privilege
- Allow sysadm_t to run/transition to dracut_t

Applications, such as dracut or other initramfs creators, need read access to udev rules to see if they need to pull in additional requirements for the initramfs or not. This adds in the udev_read_rules_files() interface for this purpose.

---
 policy/modules/system/udev.if |   18 ++++++++++++++++++
 1 files changed, 18 insertions(+), 0 deletions(-)

index 025348a..3d0f1f0 100644
@@ -132,6 +132,24 @@ interface(`udev_dontaudit_rw_dgram_sockets',`
 
 ########################################
 ## <summary>
+##	Read udev rules files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`udev_read_rules_files',`
+	gen_require(`
+		type udev_rules_t;
+	')
+
+	read_files_pattern($1, udev_rules_t, udev_rules_t)
+')
+
+########################################
+## <summary>
 ##	Manage udev rules files
 ## </summary>
 ## <param name="domain">

1.7.3.4

Dracut, an application that creates an initramfs based on the systems' requirements, needs to list the module configuration files to function. This adds in this interface for this purpose.

---
 policy/modules/system/modutils.if |   19 +++++++++++++++++++
 1 files changed, 19 insertions(+), 0 deletions(-)

index 350c450..2ed57a9 100644
@@ -39,6 +39,25 @@ interface(`modutils_read_module_deps',`
 
 ########################################
 ## <summary>
+## 	List the module configuration option files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`modutils_list_module_config',`
+	gen_require(`
+		type modules_conf_t;
+	')
+	
+	list_dirs_pattern($1, modules_conf_t, modules_conf_t)
+')
+
+
+########################################
+## <summary>
 ##	Read the configuration options used when
 ##	loading modules.
 ## </summary>

1.7.3.4

Running dracut out of the sysadm_t domain doesn't (fully) work on a policy without unconfined domains. The calls to depmod, whose output is then directed to a tmp location, is denied through this. Instead of granting depmod (and other tools) "manage" access to user_tmp_t, we create a separate domain for dracut (called dracut_t) and grant these tools management access to dracut_tmp_t.

This adds in the dracut policy

---
 dracut.fc |    4 +++
 dracut.if |   69 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 dracut.te |   79 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 152 insertions(+), 0 deletions(-)
 create mode 100644 dracut.fc
 create mode 100644 dracut.if
 create mode 100644 dracut.te

new file mode 100644
index 0000000..8e411eb
@@ -0,0 +1,4 @@
+#
+# /usr
+#
+/usr/sbin/dracut	--	gen_context(system_u:object_r:dracut_exec_t,s0)

1.7.3.4

[...]

Looks like I was a bit too overzealous here, many of the _domtrans can actually be changed to _exec calls. They are never really executed, but used by ldd (which does mean the files are somewhat executed, hence the reports) to find out which libraries need to be pulled in as well.

I'll draft up a new patch "batch" soon when I've cleaned those out.

Wkr,
Sven Vermeulen

The dracut application calls, amongst other applications, ldconfig and depmod and gets them to write information in a temporary location created by dracut. This allows those domains manage access to these locations.

Write privileges alone were not sufficient as new files were created as well.

---
 policy/modules/system/libraries.te |    4 ++++
 policy/modules/system/modutils.te  |    4 ++++
 2 files changed, 8 insertions(+), 0 deletions(-)

index 5a16f99..50332d3 100644
@@ -131,6 +131,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dracut_manage_tmp_files(ldconfig_t)
+')
+
+optional_policy(`
 	puppet_rw_tmp(ldconfig_t)
 ')
 

index a8d6741..16cfe82 100644
@@ -89,6 +89,10 @@ tunable_policy(`use_samba_home_dirs',`
 ')
 
 optional_policy(`
+	dracut_manage_tmp_files(depmod_t)
+')
+
+optional_policy(`
 	rpm_rw_pipes(depmod_t)
 	rpm_manage_script_tmp_files(depmod_t)
 ')

1.7.3.4

---
 policy/modules/roles/sysadm.te |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

index 64e45ad..9d8872d 100644
@@ -148,6 +148,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dracut_run(sysadm_t, sysadm_r)
+')
+
+optional_policy(`
 	firstboot_run(sysadm_t, sysadm_r)
 ')
 

1.7.3.4