Allow udev to launch init scripts (f.i. on network module load)
PATCH 1/1 Allow udev to launch init scripts (f.i. on network module load)
--- policy/modules/system/udev.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/system/udev.te +1 -0
@@ -175,6 +175,7 @@ ifdef(`distro_gentoo',` # during boot, init scripts use /dev/.rcsysinit # existance to determine if we are in early booting init_getattr_script_status_files(udev_t) + init_domtrans_script(udev_t) ') ifdef(`distro_redhat',`
Signature · 1 line
1.7.3.4
PATCH 1/1 Allow udev to launch init scripts (f.i. on network module load)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Quoted 11 lines · Sven Vermeulen
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/system/udev.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)policy/modules/system/udev.te +0
-0
policy/modules/system/udev.te ifdef(`distro_gentoo',` · line 181
Quoted 7 lines
policy/modules/system/udev.te +1
-0@@ -175,6 +175,7 @@ ifdef(`distro_gentoo',` # during boot, init scripts use /dev/.rcsysinit # existance to determine if we are in early booting init_getattr_script_status_files(udev_t) + init_domtrans_script(udev_t) ') ifdef(`distro_redhat',`
This would be better if it specified which scripts were launched. -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1JoT8ACgkQrlYvE4MpobO9SQCfSbILR47E1hpK2sJWubG49cvN 8P0AnRMAP+kgQz3q7juwWtQRSiA3flLv
=3mqv
-----END PGP SIGNATURE-----
PATCH 1/1 Allow udev to launch init scripts (f.i. on network module load)
Quoted 9 lines · Daniel J Walsh
Quoted 9 lines
policy/modules/system/udev.te +1
-0@@ -175,6 +175,7 @@ ifdef(`distro_gentoo',` # during boot, init scripts use /dev/.rcsysinit # existance to determine if we are in early booting init_getattr_script_status_files(udev_t) + init_domtrans_script(udev_t) ')
Quoted 3 lines
policy/modules/system/udev.te ifdef(`distro_gentoo',` · line 181
Quoted 1 line
policy/modules/system/udev.te +0
-0ifdef(`distro_redhat',`This would be better if it specified which scripts were launched.
Definitely. Was wondering why git send-email didn't ask me for more information ;-) Anyhow, thanks for your tips in #selinux, now for the requested information...
In Gentoo (the patch only includes the line in a distro_gentoo section), the (default installed) 90-network.rules calls the /etc/init.d/net.<interface> init script when a network subsystem is added or removed.
Wkr,
Sven Vermeulen
PATCH 1/1 Allow udev to launch init scripts (f.i. on network module load)
Quoted 14 lines · Sven Vermeulen
Quoted 9 lines · Daniel J Walsh
Quoted 9 lines
policy/modules/system/udev.te +1
-0@@ -175,6 +175,7 @@ ifdef(`distro_gentoo',` # during boot, init scripts use /dev/.rcsysinit # existance to determine if we are in early booting init_getattr_script_status_files(udev_t) + init_domtrans_script(udev_t) ')Quoted 3 lines
policy/modules/system/udev.te ifdef(`distro_gentoo',` · line 181
Quoted 1 line
policy/modules/system/udev.te +0
-0ifdef(`distro_redhat',`This would be better if it specified which scripts were launched.
Quoted 7 lines
Definitely. Was wondering why git send-email didn't ask me for more information ;-) Anyhow, thanks for your tips in #selinux, now for the requested information...
In Gentoo (the patch only includes the line in a
distro_gentoosection), the (default installed) 90-network.rules calls the /etc/init.d/net.<interface> init script when a network subsystem is added or removed.
I believe he is saying that the scripts should be labeled, not that you're missing a description (though thats important too).
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Allow udev to launch init scripts (f.i. on network module load)
Quoted 6 lines · Christopher J. PeBenito
Quoted 3 lines
In Gentoo (the patch only includes the line in a
distro_gentoosection), the (default installed) 90-network.rules calls the /etc/init.d/net.<interface> init script when a network subsystem is added or removed.I believe he is saying that the scripts should be labeled, not that you're missing a description (though thats important too).
Well, the /etc/init.d/net.<interface> scripts are symlinks to a script labelled initrc_exec_t as one would imagine from an init script. udev itself (running in udev_t domain) calls a wrapper script net.sh (labelled bin_t).
You'd rather see this wrapper script be labelled something like udev_net_exec_t which transitions to udev_net_t which then calls the net.<interface> script (initrc_exec_t) which transitions to initrc_t ?
Wkr,
Sven Vermeulen
PATCH 1/1 Allow udev to launch init scripts (f.i. on network module load)
Quoted 8 lines · Sven Vermeulen
Quoted 6 lines · Christopher J. PeBenito
Quoted 3 lines
In Gentoo (the patch only includes the line in a
distro_gentoosection), the (default installed) 90-network.rules calls the /etc/init.d/net.<interface> init script when a network subsystem is added or removed.I believe he is saying that the scripts should be labeled, not that you're missing a description (though thats important too).
Quoted 7 lines
Well, the /etc/init.d/net.<interface> scripts are symlinks to a script labelled
initrc_exec_tas one would imagine from an init script. udev itself (running inudev_tdomain) calls a wrapper scriptnet.sh(labelledbin_t).You'd rather see this wrapper script be labelled something like
udev_net_exec_twhich transitions toudev_net_twhich then calls the net.<interface> script (initrc_exec_t) which transitions toinitrc_t?
Making something like network_initrc_exec_t and labeling all the basic networking scripts with it, and then transitioning to initrc_t is what we mean.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com