Using init_daemon_pid_file
cover Using init_daemon_pid_file
This patchset introduces the init_daemon_pid_file interface, deprecates init_daemon_run_dir and updates the non-contrib modules to use the new init_daemon_pid_file interface.
Sven Vermeulen (3):
Support initrc_t generated pid files with file transition Deprecate init_daemon_run_dir interface
Use init_daemon_pid_file instead of init_daemon_run_dir
policy/modules/services/postgresql.te | 2 +- policy/modules/services/ssh.te | 2 +- policy/modules/system/init.if | 38 ++++++++++++++++++++++++++++++++--- policy/modules/system/init.te | 9 +++++---- policy/modules/system/setrans.te | 2 +- policy/modules/system/sysnetwork.te | 2 +- policy/modules/system/udev.te | 2 +- 7 files changed, 45 insertions(+), 12 deletions(-)
Signature · 1 line
1.8.5.5
PATCH 1/3 Support initrc_t generated pid files with file transition
For some daemons, it is the init script that is responsible for creating the PID file of the daemon. As we do not want to update the init SELinux policy module for each of these situations, we need to introduce an interface that can be called by the SELinux policy module of the caller (the daemon domain).
The initial suggestion was to transform the init_daemon_run_dir interface, which offers a similar approach for directories in /run, into a class-agnostic interface. Several names have been suggested, such as init_script_spec_run_content or init_script_generic_run_filetrans_spec, but in the end init_daemon_pid_file was used.
The interface requires the class(es) on which the file transition should occur, like so:
init_daemon_pid_file(xdm_var_run_t, dir, "xdm") init_daemon_pid_file(postgresql_var_run_t, file, "postgresql.pid")
--- policy/modules/system/init.if | 33 +++++++++++++++++++++++++++++++++ policy/modules/system/init.te | 6 ++++++ 2 files changed, 39 insertions(+)
policy/modules/system/init.if +33 -0
@@ -412,6 +412,39 @@ interface(`init_ranged_system_domain',` ######################################## ## <summary> +## Mark the file type as a daemon pid file, allowing initrc_t +## to create it +## </summary> +## <param name="filetype"> +## <summary> +## Type to mark as a daemon pid file +## </summary> +## </param> +## <param name="class"> +## <summary> +## Class on which the type is applied +## </summary> +## </param> +## <param name="filename"> +## <summary> +## Filename of the file that the init script creates +## </summary> +## </param> +# +interface(`init_daemon_pid_file',` + gen_require(` + attribute daemonpidfile; + type initrc_t; + ') + + typeattribute $1 daemonpidfile; + + files_pid_file($1) + files_pid_filetrans(initrc_t, $1, $2, $3) +') + +######################################## +## <summary> ## Mark the file type as a daemon run dir, allowing initrc_t ## to create it ## </summary>
policy/modules/system/init.te +6 -0
@@ -23,6 +23,8 @@ attribute init_run_all_scripts_domain; # Mark process types as daemons attribute daemon; +# Mark file type as a daemon pid file +attribute daemonpidfile; # Mark file type as a daemon run directory attribute daemonrundir;
@@ -247,6 +249,10 @@ init_telinit(initrc_t) can_exec(initrc_t, init_script_file_type) +create_dirs_pattern(initrc_t, daemonpidfile, daemonpidfile) +manage_files_pattern(initrc_t, daemonpidfile, daemonpidfile) +setattr_dirs_pattern(initrc_t, daemonpidfile, daemonpidfile) + create_dirs_pattern(initrc_t, daemonrundir, daemonrundir) setattr_dirs_pattern(initrc_t, daemonrundir, daemonrundir)
Signature · 1 line
1.8.5.5
PATCH 2/3 Deprecate init_daemon_run_dir interface
In reply to Sven VermeulenWith init_daemon_pid_file supporting class parameters, all calls to init_daemon_run_dir can now be transformed into init_daemon_pid_file calls.
Update the init_daemon_run_dir interface so it gives a warning when used, and use the init_daemon_pid_file interface underlyingly.
--- policy/modules/system/init.if | 5 ++--- policy/modules/system/init.te | 5 ----- 2 files changed, 2 insertions(+), 8 deletions(-)
policy/modules/system/init.if +2 -3
@@ -465,9 +465,8 @@ interface(`init_daemon_run_dir',` type initrc_t; ') - typeattribute $1 daemonrundir; - - files_pid_filetrans(initrc_t, $1, dir, $2) + refpolicywarn(`$0($*) has been deprecated, use init_daemon_pid_file() instead.') + init_daemon_pid_file($1, dir, $2) ') ########################################
policy/modules/system/init.te +0 -5
@@ -25,8 +25,6 @@ attribute daemon; # Mark file type as a daemon pid file attribute daemonpidfile; -# Mark file type as a daemon run directory -attribute daemonrundir; # # init_t is the domain of the init process.
@@ -253,9 +251,6 @@ create_dirs_pattern(initrc_t, daemonpidfile, daemonpidfile) manage_files_pattern(initrc_t, daemonpidfile, daemonpidfile) setattr_dirs_pattern(initrc_t, daemonpidfile, daemonpidfile) -create_dirs_pattern(initrc_t, daemonrundir, daemonrundir) -setattr_dirs_pattern(initrc_t, daemonrundir, daemonrundir) - domtrans_pattern(init_run_all_scripts_domain, initrc_exec_t, initrc_t) manage_dirs_pattern(initrc_t, initrc_state_t, initrc_state_t)
Signature · 1 line
1.8.5.5
PATCH 2/3 Deprecate init_daemon_run_dir interface
Quoted 13 lines · Sven Vermeulen
With
init_daemon_pid_filesupporting class parameters, all calls toinit_daemon_run_dircan now be transformed intoinit_daemon_pid_filecalls.Update the
init_daemon_run_dirinterface so it gives a warning when used, and use theinit_daemon_pid_fileinterface underlyingly.Signed-off-by Sven Vermeulen <[email protected]>---
policy/modules/system/init.te attribute daemon; · line 30
Quoted 8 lines
policy/modules/system/init.te +0
-2@@ -25,8 +25,6 @@ attribute daemon; # Mark file type as a daemon pid file attribute daemonpidfile; -# Mark file type as a daemon run directory -attribute daemonrundir; # # init_t is the domain of the init process.
I think I would keep this attribute for a bit for compatibility reasons. Otherwise if someone has custom policy would be forced to recompile since their module would fail to link (it would still reference this attribute). I think we just need to mark this attribute as deprecated, for future removal.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 3/3 Use init_daemon_pid_file instead of init_daemon_run_dir
In reply to Sven VermeulenUpdate non-contrib modules to use init_daemon_pid_file instead of init_daemon_run_dir.
--- policy/modules/services/postgresql.te | 2 +- policy/modules/services/ssh.te | 2 +- policy/modules/system/setrans.te | 2 +- policy/modules/system/sysnetwork.te | 2 +- policy/modules/system/udev.te | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-)
policy/modules/services/postgresql.te +1 -1
@@ -63,7 +63,7 @@ files_tmp_file(postgresql_tmp_t) type postgresql_var_run_t; files_pid_file(postgresql_var_run_t) -init_daemon_run_dir(postgresql_var_run_t, "postgresql") +init_daemon_pid_file(postgresql_var_run_t, dir, "postgresql") # database clients attribute attribute sepgsql_admin_type;
policy/modules/services/ssh.te +1 -1
@@ -85,7 +85,7 @@ type sshd_keytab_t; files_type(sshd_keytab_t) ifdef(`distro_debian',` - init_daemon_run_dir(sshd_var_run_t, "sshd") + init_daemon_pid_file(sshd_var_run_t, dir, "sshd") ') ##############################
policy/modules/system/setrans.te +1 -1
@@ -21,7 +21,7 @@ files_pid_file(setrans_var_run_t) mls_trusted_object(setrans_var_run_t) ifdef(`distro_debian',` - init_daemon_run_dir(setrans_var_run_t, "setrans") + init_daemon_pid_file(setrans_var_run_t, dir, "setrans") ') ifdef(`enable_mcs',`
policy/modules/system/sysnetwork.te +1 -1
@@ -40,7 +40,7 @@ type net_conf_t alias resolv_conf_t; files_type(net_conf_t) ifdef(`distro_debian',` - init_daemon_run_dir(net_conf_t, "network") + init_daemon_pid_file(net_conf_t, dir, "network") ') ########################################
policy/modules/system/udev.te +1 -1
@@ -25,7 +25,7 @@ files_type(udev_rules_t) type udev_var_run_t; files_pid_file(udev_var_run_t) -init_daemon_run_dir(udev_var_run_t, "udev") +init_daemon_pid_file(udev_var_run_t, dir, "udev") ifdef(`enable_mcs',` kernel_ranged_domtrans_to(udev_t, udev_exec_t, s0 - mcs_systemhigh)
Signature · 1 line
1.8.5.5