[refpolicy] [PATCH] init: update the initrc_t domain policy

[guido@trentalancia.net (Guido Trentalancia)]

Hello again.

> On the 30th of December 2016 at 20.30 Chris PeBenito <pebenito@ieee.org>
> wrote:
> 
> 
> On 12/29/16 17:49, Guido Trentalancia via refpolicy wrote:
> > Update the initrc_t domain policy in the init module with some
> > missing permissions.
> >
> > Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
> > ---
> >  policy/modules/kernel/terminal.if |   21 +++++++++++++++++++++
> >  policy/modules/system/init.te     |   19 +++++++++++++++++--
> >  2 files changed, 38 insertions(+), 2 deletions(-)

[...]

> >  domain_kill_all_domains(initrc_t)
> >  domain_signal_all_domains(initrc_t)
> > @@ -496,6 +502,8 @@ files_exec_etc_files(initrc_t)
> >  files_read_usr_files(initrc_t)
> >  files_manage_urandom_seed(initrc_t)
> >  files_manage_generic_spool(initrc_t)
> > +# manage the restorecond lock file
> > +files_manage_generic_locks(initrc_t)
> 
> initrc_t can already delete all locks.  Why does it need to create locks?

The init scripts usually create the lock file upon starting up the service (and
delete it when stopping the service).

If you look at the script file restorecond.init from
policycoreutils/restorecond, you'll find the following:

touch /var/lock/subsys/restorecond

which implies files_manage_generic_locks(initrc_t).

I hope it helps...

Regards,

Guido