RFC add systemd support to the Mainline policy from fedora's.
Get series with b4
b4 am [email protected]Versions newest first
- v3 RFC Latest0 of 4 patches 0 repliesNew
Patches in v3 No applies recorded yet
None of the 4 patches the cover letter announces are in this archive.
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v3 yet.
Cover letter [refpolicy] [RFC 0/4 v3] add systemd support to the Mainline policy from fedora's.
Quoted 5 lines · Justin Mattock
with the next four emails I am sending some patches that(hopefully) add support to systemd from fedoras policy.
Note: I am not so git savvy so creating them I had some issues with the whole contrib thing.
Anyway the first two patches are initial systemd support. and the last two are build error fixes with make load(semodule errors)I am unable to load the policy due to some libc error, and am looking into that at the moment, if anybody wants to try these out to see if this loads and runs then let me know. also I am unable to be connected all day(no office space) so responding might take some time.
Dropping the SELinux list as is unnecessary to cross post.
Same question as always, has systemd stabilized? I glanced through the first patch, and it has severe whitespace problems. It also has problems that must be fixed, such as:
@@ -861,3 +970,24 @@ optional_policy(`
optional_policy(`
zebra_read_config(initrc_t)
')
+
+tunable_policy(init_systemd',
+ allow init_t daemon:unix_stream_socket create_stream_socket_perms;
+ allow init_t daemon:unix_dgram_socket create_socket_perms;
+ allow init_t daemon:tcp_socket create_stream_socket_perms;
+ allow daemon init_t:unix_dgram_socket sendto;
+ # need write to /var/run/systemd/notify
+ init_write_pid_socket(daemon)
+ allow daemon init_t:unix_stream_socket { append write read getattr ioctl };
+')
+
+# not sure why fedora has double init_systemd here +tunable_policy(init_systemd',
+ # Handle upstart/systemd direct transition to a executable
+ allow init_t systemprocess:process { dyntransition siginh };
+ allow init_t systemprocess:unix_stream_socket create_stream_socket_perms;
+ allow init_t systemprocess:unix_dgram_socket create_socket_perms;
+ allow systemprocess init_t:unix_dgram_socket sendto;
+ allow systemprocess init_t:unix_stream_socket { append write read getattr ioctl };
+')
Instead of having two blocks, they should be combined, as alluded to by the comment. From what I can tell from the first patch, it looks like this needs more work.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com