Support dracut domain
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest5 patches 0 repliesNew
- v15 patches 0 repliesSuperseded
Patches in v2 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/5 | Add read interface for udev rulespolicy/ | +19 | 1 reply | |
| 2/5 | Support listing module configuration filespolicy/ policy/ | +25 | 1 reply | |
| 3/5 | Adding dracut policydracut.fc dracut.if dracut.te | +149 | 4 replies | |
| 3/5 | Adding dracut policy | +0 | 3 replies | |
| 3/5 | Adding dracut policy | +0 | 0 replies | |
| 3/5 | Adding dracut policy | +0 | 1 reply | |
| 3/5 | Adding dracut policy | +0 | 0 replies | |
| 4/5 | Grant dracut_manage_tmp_files to domains called by dracutpolicy/ | +4 | 1 reply | |
| 5/5 | Allow sysadm_t to call dracut and transition to dracut_tpolicy/ | +4 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v2 yet.
Cover letter [refpolicy] [PATCH v2 0/5] Support dracut domain
While trying to get a SELinux-supporting initramfs booted up (in enforcing mode, without unconfined domains) my current attempts are at dracut. But dracut itself didn't work quite well on such a system as running it in sysadm_t domain fails (some domain transitions occur which are then asked to write files in user_tmp_t which isn't allowed for those domains).
Instead of patching those domains (ldconfig_t and depmod_t) to allow writing & creating files in user_tmp_t (i.e. manage privileges) I drafted up a dracut domain (dracut_t) and grant those domains manage access to dracut_tmp_t.
To support dracut, a few changes were necessary to the policy as well (additional interfaces).
The summary:
- Add read interface for udev rules (udev_read_rules_files)
- List module configuration option files (modutils_list_module_config)
- Add in the dracut_t policy
- Grant ldconfig_t and depmod_t the dracut_manage_tmp_files privilege
- Allow sysadm_t to run/transition to dracut_t