system/init: move systemd_ interfaces into optional_policy
PATCH 1/1 system/init: move systemd_ interfaces into optional_policy
When ifdef systemd is enabled, some interfaces from systemd are called unconditionally. This makes migrating from non-systemd to systemd complicated since init is part of base and systemd is not so loading fails. Moving them into optional_policy fixes this.
--- policy/modules/system/init.te | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
policy/modules/system/init.te +5 -3
@@ -280,13 +280,15 @@ ifdef(`init_systemd',` seutil_read_file_contexts(init_t) - systemd_relabelto_kmod_files(init_t) - systemd_dbus_chat_logind(init_t) - # udevd is a "systemd kobject uevent socket activated daemon" udev_create_kobject_uevent_sockets(init_t) optional_policy(` + systemd_relabelto_kmod_files(init_t) + systemd_dbus_chat_logind(init_t) + ') + + optional_policy(` dbus_system_bus_client(init_t) dbus_connect_system_bus(init_t) ')
Signature · 1 line
2.4.10
PATCH 1/1 system/init: move systemd_ interfaces into optional_policy
Quoted 21 lines · Jason Zaman
When ifdef systemd is enabled, some interfaces from systemd are called unconditionally. This makes migrating from non-systemd to systemd complicated since init is part of base and systemd is not so loading fails. Moving them into
optional_policyfixes this.--- policy/modules/system/init.te | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)policy/modules/system/init.te +0
-3@@ -280,13 +280,15 @@ ifdef(`init_systemd',` seutil_read_file_contexts(init_t) - systemd_relabelto_kmod_files(init_t) - systemd_dbus_chat_logind(init_t) - # udevd is a "systemd kobject uevent socket activated daemon" udev_create_kobject_uevent_sockets(init_t)
policy/modules/system/init.te ifdef(`init_systemd',` · line 294
Quoted 10 lines
policy/modules/system/init.te +5
-0optional_policy(` + systemd_relabelto_kmod_files(init_t) + systemd_dbus_chat_logind(init_t) + ') + + optional_policy(` dbus_system_bus_client(init_t) dbus_connect_system_bus(init_t) ')
I don't think I follow. The lines are already in the init_systemd block, so it doesn't make sense for them to be optional. Why wouldn't systemd be in base, in this situation?
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 system/init: move systemd_ interfaces into optional_policy
Quoted 23 lines · Christopher J. PeBenito
Quoted 22 lines · Jason Zaman
When ifdef systemd is enabled, some interfaces from systemd are called unconditionally. This makes migrating from non-systemd to systemd complicated since init is part of base and systemd is not so loading fails. Moving them into
optional_policyfixes this.--- policy/modules/system/init.te | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)policy/modules/system/init.te +0
-3@@ -280,13 +280,15 @@ ifdef(`init_systemd',` seutil_read_file_contexts(init_t) - systemd_relabelto_kmod_files(init_t) - systemd_dbus_chat_logind(init_t) - # udevd is a "systemd kobject uevent socket activated daemon" udev_create_kobject_uevent_sockets(init_t)
Quoted 13 lines
policy/modules/system/init.te ifdef(`init_systemd',` · line 294
Quoted 9 lines
policy/modules/system/init.te +5
-0optional_policy(` + systemd_relabelto_kmod_files(init_t) + systemd_dbus_chat_logind(init_t) + ') + + optional_policy(` dbus_system_bus_client(init_t) dbus_connect_system_bus(init_t) ')I don't think I follow. The lines are already in the
init_systemdblock, so it doesn't make sense for them to be optional. Why wouldn't systemd be in base, in this situation?
It comes from here: https://bugs.gentoo.org/568754
The problem is does not exist once you are in either init_systemd = true/false. It is only a problem during the rebuild/reload when transitioning from false->true.
The problem is init.pp is rebuilt with init_systemd enabled in the base package. systemd.pp will be built later in sec-policy/selinux-systemd (just like sec-policy/selinux-openrc) which systemd will depend on. Having selinux-base provide systemd.pp seems a bit strange since then even non-systemd people need the module loaded.
Once everything is loaded there are no problems anymore. The only problem is migrating or during a first install when there is no policy yet.
-- Jason
PATCH 1/1 system/init: move systemd_ interfaces into optional_policy
In reply to Jason ZamanQuoted 21 lines · Jason Zaman
When ifdef systemd is enabled, some interfaces from systemd are called unconditionally. This makes migrating from non-systemd to systemd complicated since init is part of base and systemd is not so loading fails. Moving them into
optional_policyfixes this.--- policy/modules/system/init.te | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)policy/modules/system/init.te +0
-3@@ -280,13 +280,15 @@ ifdef(`init_systemd',` seutil_read_file_contexts(init_t) - systemd_relabelto_kmod_files(init_t) - systemd_dbus_chat_logind(init_t) - # udevd is a "systemd kobject uevent socket activated daemon" udev_create_kobject_uevent_sockets(init_t)
policy/modules/system/init.te ifdef(`init_systemd',` · line 294
Quoted 10 lines
policy/modules/system/init.te +5
-0optional_policy(` + systemd_relabelto_kmod_files(init_t) + systemd_dbus_chat_logind(init_t) + ') + + optional_policy(` dbus_system_bus_client(init_t) dbus_connect_system_bus(init_t) ')
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com