Re: start of patch to dpkg's start-stop-daemon

[Russell Coker <rcoker@redhat.com>]

On Fri, 21 May 2004 02:23, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
> > > it's a patch to dpkg 1.10.21's utils/start-stop-daemon.c
> > > which causes a context switch just before
> > > the setuid/setgid calls.
> >
> > What is the benefit in that?
>
>  it's easier than breaking pre-existing /etc/init.d/* scripts where
>  people expect the -u option to act as it should?

How is it broken?  initrc_t has setuid and setgid capabilities so SE Linux 
does not stop the regular function of start-stop-daemon.

In fact it's good for start-stop-daemon to be used to run a daemon as UID != 
0, that means that the daemon domain does not need setuid capability.

>  in other words, the benefit in patching start-stop-daemon is to
>  provide legacy transition support.

My systems have been working fine with a non-patched start-stop-daemon for two 
years.  When I first started working on SE Linux I had a similar idea to 
avoid the use of run_init, that turned out to be a bad idea and I've been 
using the regular start-stop-daemon since then.

>  i _really_ don't want the -u option on my custom /etc/init.d/custom
>  script to suddenly start running the daemon as root.

Why not?

If root is the appropriate UID for Unix permissions to allow all required 
operations, then this is OK as SE Linux can still prevent it from doing 
anything bad.

>  as an inexperienced SE/Linux user i might not _know_ that i have to
>  write a domain_auto_trans() rule in the /etc/selinux policy.
>
>  therefore all of a sudden, by upgrading to SE/Linux i suddenly have
>  my -u option effectively ignored.

No, if you install a daemon which has no policy and you don't write any then 
the daemon will run as initrc_t.  This may allow the daemon to work or may 
prevent it from operating depending on what the daemon does.

>  under which circumstances, what you are saying is that
>  because the script will run as system_u:system_r:initrc_t,
>  and because that context will not have (shouldn't have!)
>  permission to do anything outrageous, my startup script will
>  break.

initrc_t has a lot of access to the system.  It's designed for startup scripts 
and breaks very few of them.

-- 
http://apac.redhat.com/disclaimer
See above URL for disclaimer.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.