Skip to content

Support dracut domain

Sven Vermeulen selinux-refpolicy 2 versions – New

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v2 Latest5 patches 0 repliesNew
  2. v15 patches 0 repliesSuperseded

Patches in v2 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/5Add read interface for udev rulespolicy/modules/system/udev.if+19 -01 reply
2/5Support listing module configuration filespolicy/modules/system/modutils.if policy/modules/system/modutils.te+25 -01 reply
3/5Adding dracut policydracut.fc dracut.if dracut.te+149 -04 replies
3/5Adding dracut policy+0 -03 replies
3/5Adding dracut policy+0 -00 replies
3/5Adding dracut policy+0 -01 reply
3/5Adding dracut policy+0 -00 replies
4/5Grant dracut_manage_tmp_files to domains called by dracutpolicy/modules/system/libraries.te+4 -01 reply
5/5Allow sysadm_t to call dracut and transition to dracut_tpolicy/modules/roles/sysadm.te+4 -00 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v2 yet.

Read the v2 thread

Cover letter [refpolicy] [PATCH v2 0/5] Support dracut domain

While trying to get a SELinux-supporting initramfs booted up (in enforcing mode, without unconfined domains) my current attempts are at dracut. But dracut itself didn't work quite well on such a system as running it in sysadm_t domain fails (some domain transitions occur which are then asked to write files in user_tmp_t which isn't allowed for those domains).

Instead of patching those domains (ldconfig_t and depmod_t) to allow writing & creating files in user_tmp_t (i.e. manage privileges) I drafted up a dracut domain (dracut_t) and grant those domains manage access to dracut_tmp_t.

To support dracut, a few changes were necessary to the policy as well (additional interfaces).

The summary:
- Add read interface for udev rules (udev_read_rules_files)
- List module configuration option files (modutils_list_module_config)
- Add in the dracut_t policy
- Grant ldconfig_t and depmod_t the dracut_manage_tmp_files privilege
- Allow sysadm_t to run/transition to dracut_t