From: sven.vermeulen@siphos.be (Sven Vermeulen)
To: refpolicy@oss.tresys.com
Subject: [refpolicy] [PATCH 3/5] Adding dracut policy
Date: Thu, 5 Jan 2012 20:28:31 +0100 [thread overview]
Message-ID: <20120105192831.GA29115@siphos.be> (raw)
In-Reply-To: <20120104200247.GD6512@siphos.be>
On Wed, Jan 04, 2012 at 09:02:47PM +0100, Sven Vermeulen wrote:
> Running dracut out of the sysadm_t domain doesn't (fully) work on a policy without unconfined domains. The calls to depmod,
> whose output is then directed to a tmp location, is denied through this. Instead of granting depmod (and other tools)
> "manage" access to user_tmp_t, we create a separate domain for dracut (called dracut_t) and grant these tools management
> access to dracut_tmp_t.
[...]
Looks like I was a bit too overzealous here, many of the _domtrans can
actually be changed to _exec calls. They are never really executed, but used
by ldd (which does mean the files are somewhat executed, hence the reports)
to find out which libraries need to be pulled in as well.
I'll draft up a new patch "batch" soon when I've cleaned those out.
Wkr,
Sven Vermeulen
next prev parent reply other threads:[~2012-01-05 19:28 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-04 20:00 [refpolicy] [PATCH 0/5] Adding support for dracut Sven Vermeulen
2012-01-04 20:01 ` [refpolicy] [PATCH 1/5] Add read interface for udev rules Sven Vermeulen
2012-01-04 20:01 ` [refpolicy] [PATCH 2/5] Support listing module configuration files Sven Vermeulen
2012-01-04 20:02 ` [refpolicy] [PATCH 3/5] Adding dracut policy Sven Vermeulen
2012-01-05 19:28 ` Sven Vermeulen [this message]
2012-01-04 20:03 ` [refpolicy] [PATCH 4/5] Grant dracut_manage_tmp_files to domains called by dracut Sven Vermeulen
2012-01-04 20:03 ` [refpolicy] [PATCH 5/5] Allow sysadm_t to call dracut and transition to dracut_t Sven Vermeulen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120105192831.GA29115@siphos.be \
--to=sven.vermeulen@siphos.be \
--cc=refpolicy@oss.tresys.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.