Update policy for selinux userspace moving the policy store to /var/lib/selinux

With the new userspace, the only files in /var/lib/selinux are selinux store related files, so label it and everything inside it as semanage_store_t. semanage_var_lib_t is completely removed and now aliases semanage_store_t for backwards compatibility. This differs from the v2 patch in that it adds back the ability to manage selinux_config_t, which is necessary to manage the old module store for things like migrating from the old to new store and backwards compatability.

Signed-off-by Steve Lawrence <[email protected]>

---
 policy/modules/system/selinuxutil.fc | 5 ++++-
 policy/modules/system/selinuxutil.if | 2 ++
 policy/modules/system/selinuxutil.te | 8 +-------
 3 files changed, 7 insertions(+), 8 deletions(-)

policy/modules/system/selinuxutil.fc +4 -1

index ec19d63..7616b31 100644
@@ -41,11 +41,14 @@
 /usr/sbin/setsebool		--	gen_context(system_u:object_r:semanage_exec_t,s0)
 /usr/sbin/semanage		--	gen_context(system_u:object_r:semanage_exec_t,s0)
 /usr/sbin/semodule		--	gen_context(system_u:object_r:semanage_exec_t,s0)
+/usr/libexec/selinux/semanage_migrate_store		--	gen_context(system_u:object_r:semanage_exec_t,s0)
 
 #
 # /var/lib
 #
-/var/lib/selinux(/.*)?			gen_context(system_u:object_r:semanage_var_lib_t,s0)
+/var/lib/selinux(/.*)?			gen_context(system_u:object_r:semanage_store_t,s0)
+/var/lib/selinux/[^/]+/semanage\.read\.LOCK -- gen_context(system_u:object_r:semanage_read_lock_t,s0)
+/var/lib/selinux/[^/]+/semanage\.trans\.LOCK -- gen_context(system_u:object_r:semanage_trans_lock_t,s0)
 
 #
 # /var/run

policy/modules/system/selinuxutil.if +2 -0

index bee06f4..129a6e0 100644
@@ -1041,7 +1041,9 @@ interface(`seutil_manage_module_store',`
 	')
 
 	files_search_etc($1)
+	files_search_var($1)
 	manage_dirs_pattern($1, selinux_config_t, semanage_store_t)
+	manage_dirs_pattern($1, semanage_store_t, semanage_store_t)
 	manage_files_pattern($1, semanage_store_t, semanage_store_t)
 	manage_lnk_files_pattern($1, semanage_store_t, semanage_store_t)
 ')

policy/modules/system/selinuxutil.te +1 -7

index c322a6f..43cf82d 100644
@@ -100,7 +100,7 @@ application_domain(semanage_t, semanage_exec_t)
 domain_interactive_fd(semanage_t)
 role semanage_roles types semanage_t;
 
-type semanage_store_t;
+type semanage_store_t alias semanage_var_lib_t;
 files_type(semanage_store_t)
 
 type semanage_read_lock_t;

@@ -112,9 +112,6 @@ files_tmp_file(semanage_tmp_t)
 type semanage_trans_lock_t;
 files_type(semanage_trans_lock_t)
 
-type semanage_var_lib_t;
-files_type(semanage_var_lib_t)
-
 type setfiles_t alias restorecon_t, can_relabelto_binary_policy;
 type setfiles_exec_t alias restorecon_exec_t;
 init_system_domain(setfiles_t, setfiles_exec_t)

@@ -454,9 +451,6 @@ allow semanage_t semanage_tmp_t:dir manage_dir_perms;
 allow semanage_t semanage_tmp_t:file manage_file_perms;
 files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir })
 
-manage_dirs_pattern(semanage_t, semanage_var_lib_t, semanage_var_lib_t)
-manage_files_pattern(semanage_t, semanage_var_lib_t, semanage_var_lib_t)
-
 kernel_read_system_state(semanage_t)
 kernel_read_kernel_sysctls(semanage_t)