Skip to contentSkip to conversation

Label /var/run/mdadm/map as mdadm_map_t

PATCH New Laurent Bigonville 5 participants 8 messages Sep 11, 2012 – Sep 14, 2012

lore
Share & tools
lore

Laurent Bigonville

author
#0 lore raw

PATCH 1/2 Label /var/run/mdadm/map as mdadm_map_t

From: Laurent Bigonville <[email protected]>

mdadm is now creating map file under /run/mdadm/map

---
 raid.fc |    1 +
 1 file changed, 1 insertion(+)
raid.fc +1 -0
index ed9c70d..e3c8bfb 100644
@@ -4,3 +4,4 @@
 /sbin/mdmpd		--	gen_context(system_u:object_r:mdadm_exec_t,s0)
 
 /var/run/mdadm(/.*)?		gen_context(system_u:object_r:mdadm_var_run_t,s0)
+/var/run/mdadm/map	--	gen_context(system_u:object_r:mdadm_map_t,s0)
Signature · 1 line
1.7.10.4
author
#1 lore raw

PATCH 2/2 Add Debian location for accounts-daemon daemon

From: Laurent Bigonville <[email protected]>

---
 accountsd.fc |    4 ++++
 1 file changed, 4 insertions(+)
accountsd.fc +4 -0
index 1adca53..414e917 100644
@@ -1,3 +1,7 @@
 /usr/libexec/accounts-daemon		--	gen_context(system_u:object_r:accountsd_exec_t,s0)
 
+ifdef(`distro_debian',`
+/usr/lib/accountsservice/accounts-daemon	--	gen_context(system_u:object_r:accountsd_exec_t,s0)
+')
+
 /var/lib/AccountsService(/.*)?			gen_context(system_u:object_r:accountsd_var_lib_t,s0)
Signature · 1 line
1.7.10.4
#2 lore raw

PATCH 2/2 Add Debian location for accounts-daemon daemon

Quoted 11 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 accountsd.fc |    4 ++++
 1 file changed, 4 insertions(+)
accountsd.fc +0 -0
index 1adca53..414e917 100644

accountsd.fc line 7

Quoted 7 lines
accountsd.fc +4 -0
@@ -1,3 +1,7 @@
 /usr/libexec/accounts-daemon		--	gen_context(system_u:object_r:accountsd_exec_t,s0)
 
+ifdef(`distro_debian',`
+/usr/lib/accountsservice/accounts-daemon	--	gen_context(system_u:object_r:accountsd_exec_t,s0)
+')
+
 /var/lib/AccountsService(/.*)?			gen_context(system_u:object_r:accountsd_var_lib_t,s0)

This was merged, thanks

#3 lore raw

PATCH 1/2 Label /var/run/mdadm/map as mdadm_map_t

In reply to Laurent Bigonville
Quoted 12 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

mdadm is now creating map file under /run/mdadm/map

---
 raid.fc |    1 +
 1 file changed, 1 insertion(+)
raid.fc +0 -0
index ed9c70d..e3c8bfb 100644

raid.fc line 7

Quoted 4 lines
raid.fc +1 -0
@@ -4,3 +4,4 @@
 /sbin/mdmpd		--	gen_context(system_u:object_r:mdadm_exec_t,s0)
 
 /var/run/mdadm(/.*)?		gen_context(system_u:object_r:mdadm_var_run_t,s0)
+/var/run/mdadm/map	--	gen_context(system_u:object_r:mdadm_map_t,s0)

I think its probably best to drop mdadm_map_t and make it an alias of mdadm_var_run_t instead

I have some changes from both myself and fedora for raid module in the pipeline.

It sucks though because both fedora as well as refpolicy made mdadm_t a unconfined type. That basically makes it almost impossible for us to develop it further and receive feedback on it.

#4 lore raw

PATCH 1/2 Label /var/run/mdadm/map as mdadm_map_t

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 21 lines · Dominick Grift
Quoted 11 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

mdadm is now creating map file under /run/mdadm/map --- raid.fc | 1 +

1 file changed, 1 insertion(+)
raid.fc index ed9c70d..e3c8bfb 100644 --- renamed from raid.fc +0 -0

a/raid.fc +++ b/raid.fc @@ -4,3 +4,4 @@ /sbin/mdmpd --
gen_context(system_u:object_r:mdadm_exec_t,s0)

/var/run/mdadm(/.*)? gen_context(system_u:object_r:mdadm_var_run_t,s0)
+/var/run/mdadm/map -- gen_context(system_u:object_r:mdadm_map_t,s0)

I think its probably best to drop mdadm_map_t and make it an alias of mdadm_var_run_t instead

I have some changes from both myself and fedora for raid module in the pipeline.

Quoted 7 lines

It sucks though because both fedora as well as refpolicy made mdadm_t a unconfined type. That basically makes it almost impossible for us to develop it further and receive feedback on it.

_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy

Dominick lets turn that off in Rawhide.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iEYEARECAAYFAlBR/Y8ACgkQrlYvE4MpobO3CQCgqM77dqA/OM9r7a16r7PNfAHP rnwAoNCHmqHjQmcN/g1eQj4vj7MlMhSi
=2osU
-----END PGP SIGNATURE-----

#5 lore raw

PATCH 1/2 Label /var/run/mdadm/map as mdadm_map_t

Quoted 22 lines · Daniel J Walsh
Quoted 21 lines · Dominick Grift
Quoted 11 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

mdadm is now creating map file under /run/mdadm/map --- raid.fc | 1 +

1 file changed, 1 insertion(+)
raid.fc index ed9c70d..e3c8bfb 100644 --- renamed from raid.fc +0 -0

a/raid.fc +++ b/raid.fc @@ -4,3 +4,4 @@ /sbin/mdmpd --
gen_context(system_u:object_r:mdadm_exec_t,s0)

/var/run/mdadm(/.*)? gen_context(system_u:object_r:mdadm_var_run_t,s0)
+/var/run/mdadm/map -- gen_context(system_u:object_r:mdadm_map_t,s0)

I think its probably best to drop mdadm_map_t and make it an alias of mdadm_var_run_t instead

I have some changes from both myself and fedora for raid module in the pipeline.

Quoted 9 lines
Quoted 7 lines

It sucks though because both fedora as well as refpolicy made mdadm_t a unconfined type. That basically makes it almost impossible for us to develop it further and receive feedback on it.

_______________________________________________ refpolicy mailing list refpolicy at oss.tresys.com http://oss.tresys.com/mailman/listinfo/refpolicy

Dominick lets turn that off in Rawhide.

That is a good idea. I would like to hear pebenito' opinion about removing it in refpolicy as well.

what caused refpolicy to make mdadm_t a unconfined domain in the first place?

#6 lore raw

PATCH 1/2 Label /var/run/mdadm/map as mdadm_map_t

Quoted 29 lines · Dominick Grift
Quoted 26 lines · Daniel J Walsh
Quoted 25 lines · Dominick Grift
Quoted 11 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

mdadm is now creating map file under /run/mdadm/map --- raid.fc | 1 +

1 file changed, 1 insertion(+)
raid.fc index ed9c70d..e3c8bfb 100644 --- renamed from raid.fc +0 -0

a/raid.fc +++ b/raid.fc @@ -4,3 +4,4 @@ /sbin/mdmpd --
gen_context(system_u:object_r:mdadm_exec_t,s0)

/var/run/mdadm(/.*)? gen_context(system_u:object_r:mdadm_var_run_t,s0)
+/var/run/mdadm/map -- gen_context(system_u:object_r:mdadm_map_t,s0)

I think its probably best to drop mdadm_map_t and make it an alias of mdadm_var_run_t instead

I have some changes from both myself and fedora for raid module in the pipeline.

It sucks though because both fedora as well as refpolicy made mdadm_t a unconfined type. That basically makes it almost impossible for us to develop it further and receive feedback on it.

Quoted 8 lines
Quoted 2 lines

Dominick lets turn that off in Rawhide.

That is a good idea. I would like to hear pebenito' opinion about removing it in refpolicy as well.

what caused refpolicy to make mdadm_t a unconfined domain in the first place?

I'm fine with it. I suspect its a remnant of the original targeted policy where only network-facing services were confined.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#7 lore raw

PATCH 1/2 Label /var/run/mdadm/map as mdadm_map_t

Quoted 1 line · Christopher J. PeBenito

I'm fine with it. I suspect its a remnant of the original targeted

policy where only network-facing services were confined.

We have been running without unconfined in Gentoo on quite a few systems
with raid and swraid with little additional patches on the domain. I even think without patches, but don't have access to the patch list currently to verify.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20120914/747e36d2/attachment.html