[refpolicy] Kernel-triggered scripts

[sven.vermeulen@siphos.be (Sven Vermeulen)]

Hi guys,

One of the init systems that Gentoo supports uses kernel-triggered scripts
for managing cgroups (I'm pretty sure others do a similar thing). If the
script is labeled as bin_t, the execution of the script runs as kernel_t.

I'd like to set up a proper domain transition for this, but I'm not sure
where to position it exactly. It is part of the init system, but it has
little to do with "init" by itself, so I'm inclined to put it in either a
separate module, or inside the portage module.

What do other distributions do with kernel-triggered scripts? Let them run
in the kernel_t domain? The domain runs as unconfined if you support
unconfined domains, so it is possible most distributions have less impact on
such things).

Wkr,
	Sven Vermeulen