Patch to make udev/tmpfs work and changes from colin walters for dbus.

All of lore.kernel.org
 help / color / mirror / Atom feed

* Patch to make udev/tmpfs work and changes from colin  walters for dbus.
@ 2004-09-07 20:45 Daniel J Walsh
  2004-09-08  0:00 ` Luke Kenneth Casson Leighton
                   ` (2 more replies)
  0 siblings, 3 replies; 10+ messages in thread
From: Daniel J Walsh @ 2004-09-07 20:45 UTC (permalink / raw)
  To: Stephen Smalley, SELinux

[-- Attachment #1: Type: text/plain, Size: 141 bytes --]

Adding

restorecon /dev /dev/null
restorecon /dev/*

and the attached policy patch seems to clear up the problems with udev 
and tmpfs.

Dan

[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 18218 bytes --]

diff --exclude-from=exclude -N -u -r nsapolicy/attrib.te policy-1.17.10/attrib.te
--- nsapolicy/attrib.te	2004-09-01 14:00:01.000000000 -0400
+++ policy-1.17.10/attrib.te	2004-09-07 15:55:15.049943838 -0400
@@ -347,9 +347,6 @@
 # For web clients such as netscape and squid
 attribute web_client_domain;
 
-# For a dbus client
-attribute dbus_client_domain;
-
 # For X Window System server domains
 attribute xserver;
 
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/hostname.te policy-1.17.10/domains/program/hostname.te
--- nsapolicy/domains/program/hostname.te	2004-08-27 14:44:11.000000000 -0400
+++ policy-1.17.10/domains/program/hostname.te	2004-09-07 15:56:44.609170450 -0400
@@ -22,3 +22,4 @@
 
 # for when /usr is not mounted
 dontaudit hostname_t file_t:dir search;
+dontaudit hostname_t tmpfs_t:chr_file { read write };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/init.te policy-1.17.10/domains/program/init.te
--- nsapolicy/domains/program/init.te	2004-09-02 08:03:26.000000000 -0400
+++ policy-1.17.10/domains/program/init.te	2004-09-07 15:56:26.230974473 -0400
@@ -49,7 +49,7 @@
 ')
 
 # Create /dev/initctl.
-file_type_auto_trans(init_t, device_t, initctl_t, fifo_file)
+file_type_auto_trans(init_t, { device_t tmpfs_t }, initctl_t, fifo_file)
 
 # Create ioctl.save.
 file_type_auto_trans(init_t, etc_t, etc_runtime_t, file)
@@ -114,8 +114,7 @@
 can_setbool(init_t)
 
 # Read and write the console and ttys.
-allow init_t console_device_t:chr_file rw_file_perms;
-allow init_t tty_device_t:chr_file rw_file_perms;
+allow init_t { tmpfs_t tty_device_t console_device_t } :chr_file rw_file_perms;
 allow init_t ttyfile:chr_file rw_file_perms;
 allow init_t ptyfile:chr_file rw_file_perms;
 
@@ -140,3 +139,5 @@
 
 # file descriptors inherited from the rootfs.
 dontaudit init_t root_t:{ file chr_file } { read write }; 
+
+rw_dir_file(init_t, tmpfs_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.17.10/domains/program/restorecon.te
--- nsapolicy/domains/program/restorecon.te	2004-08-27 14:44:11.000000000 -0400
+++ policy-1.17.10/domains/program/restorecon.te	2004-09-07 15:57:33.287384531 -0400
@@ -41,7 +41,9 @@
 allow restorecon_t unlabeled_t:dir_file_class_set { getattr relabelfrom };
 allow restorecon_t unlabeled_t:dir read;
 allow restorecon_t device_type:{ chr_file blk_file } { getattr relabelfrom relabelto };
-allow restorecon_t device_t:{ chr_file blk_file } { getattr relabelfrom };
+allow restorecon_t { tmpfs_t device_t device_type }:{chr_file blk_file} { getattr relabelfrom relabelto };
+allow restorecon_t tmpfs_t:{chr_file blk_file} { read write };
+
 allow restorecon_t ptyfile:chr_file getattr;
 
 allow restorecon_t fs_t:filesystem getattr;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/bluetooth.te policy-1.17.10/domains/program/unused/bluetooth.te
--- nsapolicy/domains/program/unused/bluetooth.te	2004-08-27 14:44:11.000000000 -0400
+++ policy-1.17.10/domains/program/unused/bluetooth.te	2004-09-07 15:55:15.094939442 -0400
@@ -8,7 +8,7 @@
 #
 # Rules for the bluetooth_t domain.
 #
-daemon_domain(bluetooth, `, dbus_client_domain')
+daemon_domain(bluetooth)
 
 file_type_auto_trans(bluetooth_t, var_run_t, bluetooth_var_run_t, sock_file)
 
@@ -22,6 +22,7 @@
 # Use the network.
 can_network(bluetooth_t)
 can_ypbind(bluetooth_t)
+dbusd_client(system, bluetooth_t)
 allow bluetooth_t self:socket { create setopt ioctl bind listen };
 allow bluetooth_t self:unix_dgram_socket create_socket_perms;
 allow bluetooth_t self:unix_stream_socket create_stream_socket_perms;
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cups.te policy-1.17.10/domains/program/unused/cups.te
--- nsapolicy/domains/program/unused/cups.te	2004-08-30 09:49:15.000000000 -0400
+++ policy-1.17.10/domains/program/unused/cups.te	2004-09-07 15:55:15.138935145 -0400
@@ -12,7 +12,7 @@
 # cupsd_exec_t is the type of the cupsd executable.
 #
 type ipp_port_t, port_type;
-daemon_domain(cupsd, `, auth_chkpwd, dbus_client_domain')
+daemon_domain(cupsd, `, auth_chkpwd')
 etcdir_domain(cupsd)
 typealias cupsd_etc_t alias etc_cupsd_t;
 type cupsd_rw_etc_t, file_type, sysadmfile, usercanread;
@@ -20,6 +20,7 @@
 
 can_network(cupsd_t)
 can_ypbind(cupsd_t)
+dbusd_client(system, cupsd_t)
 logdir_domain(cupsd)
 
 tmp_domain(cupsd)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dbusd.te policy-1.17.10/domains/program/unused/dbusd.te
--- nsapolicy/domains/program/unused/dbusd.te	2004-09-01 14:00:02.000000000 -0400
+++ policy-1.17.10/domains/program/unused/dbusd.te	2004-09-07 15:55:15.028945889 -0400
@@ -2,34 +2,17 @@
 #
 # Author:  Russell Coker <russell@coker.com.au>
 
-daemon_domain(dbusd, `, userspace_objmgr')
-type etc_dbusd_t, file_type, sysadmfile;
+dbusd_domain(system)
 
-allow dbusd_t dbusd_var_run_t:sock_file create_file_perms;
+allow system_dbusd_t dbusd_var_run_t:sock_file create_file_perms;
 
 ifdef(`pamconsole.te', `
-r_dir_file(dbusd_t, pam_var_console_t)
+r_dir_file(system_dbusd_t, pam_var_console_t)
 ')
 
-r_dir_file(dbusd_t, etc_dbusd_t)
-allow dbusd_t self:unix_stream_socket create_stream_socket_perms;
-allow dbusd_t self:unix_dgram_socket create_socket_perms;
-
-allow dbusd_t etc_t:file { getattr read };
 # dac_override: /var/run/dbus is owned by messagebus on Debian
-allow dbusd_t self:capability { dac_override setgid setuid };
-allow dbusd_t self:file { getattr read };
-allow dbusd_t proc_t:file { read };
-can_ypbind(dbusd_t)
+allow system_dbusd_t self:capability { dac_override setgid setuid };
+can_ypbind(system_dbusd_t)
 
 # I expect we need more than this
-allow { dbus_client_domain userdomain } { var_run_t dbusd_var_run_t }:dir search;
-allow { dbus_client_domain userdomain } dbusd_var_run_t:sock_file { write };
-allow { dbus_client_domain userdomain } dbusd_t:unix_stream_socket { connectto };
-
-# Permissions for SE-DBus operation
-r_dir_file(dbusd_t,selinux_config_t)
-
-# SE-DBus specific permissions
-allow { dbus_client_domain userdomain } { dbusd_t self }:dbus { send_msg };
-domain_auto_trans(userdomain, dbusd_exec_t, dbusd_t)
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hald.te policy-1.17.10/domains/program/unused/hald.te
--- nsapolicy/domains/program/unused/hald.te	2004-09-02 08:03:26.000000000 -0400
+++ policy-1.17.10/domains/program/unused/hald.te	2004-09-07 15:55:15.183930749 -0400
@@ -10,7 +10,7 @@
 #
 # hald_exec_t is the type of the hald executable.
 #
-daemon_domain(hald, `, dbus_client_domain, fs_domain')
+daemon_domain(hald, `, fs_domain')
 
 can_exec(hald_t, hald_exec_t)
 
@@ -18,7 +18,7 @@
 allow hald_t self:unix_stream_socket create_stream_socket_perms;
 allow hald_t self:unix_dgram_socket create_socket_perms;
 
-allow hald_t dbusd_t:dbus { acquire_svc };
+allow hald_t system_dbusd_t:dbus { acquire_svc };
 
 allow hald_t { self proc_t }:file { getattr read };
 
@@ -31,6 +31,7 @@
 allow hald_t self:capability { net_admin sys_admin };
 can_network(hald_t)
 can_ypbind(hald_t)
+dbusd_client(system, hald_t)
 
 allow hald_t device_t:lnk_file read;
 allow hald_t { fixed_disk_device_t removable_device_t }:blk_file { getattr read ioctl };
@@ -47,3 +48,5 @@
 
 allow hald_t usbdevfs_t:dir search;
 allow hald_t usbdevfs_t:file { getattr read };
+allow hald_t usbfs_t:dir search;
+allow hald_t usbfs_t:file { getattr read };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hotplug.te policy-1.17.10/domains/program/unused/hotplug.te
--- nsapolicy/domains/program/unused/hotplug.te	2004-09-01 14:00:02.000000000 -0400
+++ policy-1.17.10/domains/program/unused/hotplug.te	2004-09-07 15:55:15.128936121 -0400
@@ -11,7 +11,7 @@
 # hotplug_exec_t is the type of the hotplug executable.
 #
 ifdef(`unlimitedUtils', `
-daemon_domain(hotplug, `, admin, etc_writer, fs_domain, privmem, auth_write, privowner, privmodule, domain, privlog, sysctl_kernel_writer, dbus_client_domain, unrestricted')
+daemon_domain(hotplug, `, admin, etc_writer, fs_domain, privmem, auth_write, privowner, privmodule, domain, privlog, sysctl_kernel_writer, unrestricted')
 ', `
 daemon_domain(hotplug, `, privmodule, dbus_client_domain')
 ')
@@ -143,6 +143,7 @@
 
 can_network(hotplug_t)
 can_ypbind(hotplug_t)
+dbusd_client(system, hotplug_t)
 
 # Allow hotplug (including /sbin/ifup-local) to start/stop services and # run sendmail -q
 domain_auto_trans(hotplug_t, initrc_exec_t, initrc_t)
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/kudzu.te policy-1.17.10/domains/program/unused/kudzu.te
--- nsapolicy/domains/program/unused/kudzu.te	2004-08-27 14:44:11.000000000 -0400
+++ policy-1.17.10/domains/program/unused/kudzu.te	2004-09-07 15:54:49.325454423 -0400
@@ -29,6 +29,8 @@
 allow kudzu_t sysctl_kernel_t:file { getattr read write };
 allow kudzu_t usbdevfs_t:dir search;
 allow kudzu_t usbdevfs_t:file { getattr read };
+allow kudzu_t usbfs_t:dir search;
+allow kudzu_t usbfs_t:file { getattr read };
 allow kudzu_t var_t:dir search;
 allow kudzu_t kernel_t:system { syslog_console };
 allow kudzu_t self:udp_socket { create ioctl };
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/udev.te policy-1.17.10/domains/program/unused/udev.te
--- nsapolicy/domains/program/unused/udev.te	2004-09-01 14:00:02.000000000 -0400
+++ policy-1.17.10/domains/program/unused/udev.te	2004-09-07 16:00:22.809653212 -0400
@@ -9,7 +9,7 @@
 #
 # udev_exec_t is the type of the udev executable.
 #
-daemon_domain(udev, `, privmodule, privmem, fs_domain, privfd, dbus_client_domain')
+daemon_domain(udev, `, privmodule, privmem, fs_domain, privfd')
 
 general_domain_access(udev_t)
 
@@ -28,10 +28,10 @@
 allow udev_t self:unix_stream_socket {connectto create_stream_socket_perms};
 allow udev_t self:unix_dgram_socket create_socket_perms;
 allow udev_t self:fifo_file rw_file_perms;
-allow udev_t device_t:blk_file create_file_perms;
-allow udev_t device_t:chr_file create_file_perms;
-allow udev_t device_t:sock_file create_file_perms;
-allow udev_t device_t:lnk_file create_lnk_perms;
+allow udev_t { tmpfs_t device_t }:blk_file create_file_perms;
+allow udev_t { tmpfs_t device_t }:chr_file create_file_perms;
+allow udev_t { tmpfs_t device_t }:sock_file create_file_perms;
+allow udev_t { tmpfs_t device_t }:lnk_file create_lnk_perms;
 allow udev_t etc_t:file { getattr read };
 allow udev_t { bin_t sbin_t }:dir r_dir_perms;
 allow udev_t { sbin_t bin_t }:lnk_file read;
@@ -40,7 +40,7 @@
 can_exec(udev_t, udev_exec_t)
 r_dir_file(udev_t, sysfs_t)
 allow udev_t sysadm_tty_device_t:chr_file { read write };
-allow udev_t { device_t device_type }:{chr_file blk_file} { relabelfrom relabelto create_file_perms };
+allow udev_t { tmpfs_t device_t device_type }:{chr_file blk_file} { relabelfrom relabelto create_file_perms };
 	
 # to read the file_contexts file
 r_dir_file(udev_t, { selinux_config_t file_context_t default_context_t } )
@@ -96,3 +96,10 @@
 ifdef(`dhcpc.te', `
 domain_auto_trans(udev_t, dhcpc_exec_t, dhcpc_t)
 ')
+
+allow udev_t tmpfs_t:dir { search };
+rw_dir_create_file(udev_t, { device_t tmpfs_t })
+allow udev_t udev_helper_exec_t:dir r_dir_perms;
+
+dbusd_client(system, udev_t)
+
diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/updfstab.te policy-1.17.10/domains/program/unused/updfstab.te
--- nsapolicy/domains/program/unused/updfstab.te	2004-09-02 08:03:26.000000000 -0400
+++ policy-1.17.10/domains/program/unused/updfstab.te	2004-09-07 15:55:15.115937391 -0400
@@ -3,7 +3,7 @@
 # Author:  Russell Coker <russell@coker.com.au>
 #
 
-daemon_base_domain(updfstab, `, fs_domain, etc_writer, dbus_client_domain')
+daemon_base_domain(updfstab, `, fs_domain, etc_writer')
 
 rw_dir_create_file(updfstab_t, etc_t)
 create_dir_file(updfstab_t, mnt_t)
@@ -28,6 +28,8 @@
 
 read_locale(updfstab_t)
 
+dbusd_client(system, updfstab_t)
+
 # not sure what the sysctl_kernel_t file is, or why it wants to write it, so
 # I will not allow it
 dontaudit updfstab_t { sysctl_t sysctl_kernel_t }:dir search;
diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/named.fc policy-1.17.10/file_contexts/program/named.fc
--- nsapolicy/file_contexts/program/named.fc	2004-08-31 10:55:37.000000000 -0400
+++ policy-1.17.10/file_contexts/program/named.fc	2004-09-07 15:54:49.325454423 -0400
@@ -14,7 +14,7 @@
 ') dnl distro_debian
 
 /etc/rndc.*		--	system_u:object_r:named_conf_t
-/usr/sbin/named.*      	--	system_u:object_r:named_exec_t
+/usr/sbin/named      	--	system_u:object_r:named_exec_t
 /usr/sbin/r?ndc		--	system_u:object_r:ndc_exec_t
 /var/run/ndc		-s	system_u:object_r:named_var_run_t
 /var/run/bind(/.*)?		system_u:object_r:named_var_run_t
diff --exclude-from=exclude -N -u -r nsapolicy/macros/base_user_macros.te policy-1.17.10/macros/base_user_macros.te
--- nsapolicy/macros/base_user_macros.te	2004-09-04 07:28:25.000000000 -0400
+++ policy-1.17.10/macros/base_user_macros.te	2004-09-07 15:55:15.195929577 -0400
@@ -185,6 +185,10 @@
 can_network($1_t)
 can_ypbind($1_t)
 
+# Grant permissions to access the system DBus
+dbusd_client(system, $1_t)
+dbusd_domain($1)
+
 # allow port_t name binding for UDP because it is not very usable otherwise
 allow $1_t port_t:udp_socket name_bind;
 
diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/dbusd_macros.te policy-1.17.10/macros/program/dbusd_macros.te
--- nsapolicy/macros/program/dbusd_macros.te	1969-12-31 19:00:00.000000000 -0500
+++ policy-1.17.10/macros/program/dbusd_macros.te	2004-09-07 15:55:15.038944913 -0400
@@ -0,0 +1,62 @@
+#
+# Macros for Dbus
+#
+# Author: Colin Walters <walters@redhat.com>
+
+# dbusd_domain(domain_prefix)
+#
+# Define a derived domain for the DBus daemon.
+
+define(`dbusd_domain', `
+ifelse(`system', `$1',`
+daemon_domain(system_dbusd, `, userspace_objmgr')
+# For backwards compatibility
+typealias system_dbusd_t alias dbusd_t;
+typealias system_dbusd_exec_t alias dbusd_exec_t;
+typealias system_dbusd_var_run_t alias dbusd_var_run_t;
+type etc_dbusd_t, file_type, sysadmfile;
+',`
+ifdef(`single_userdomain', `
+typealias $1_t alias $1_dbusd_t;
+', `
+type $1_dbusd_t, domain, privlog, userspace_objmgr;
+role $1_r types $1_dbusd_t;
+domain_auto_trans($1_t, dbusd_exec_t, $1_dbusd_t)
+
+')dnl end ifdef single_userdomain
+')dnl end ifelse system
+
+base_file_read_access($1_dbusd_t)
+uses_shlib($1_dbusd_t)
+allow $1_dbusd_t etc_t:file { getattr read };
+r_dir_file($1_dbusd_t, etc_dbusd_t)
+
+allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms;
+allow $1_dbusd_t self:unix_dgram_socket create_socket_perms;
+
+allow $1_dbusd_t urandom_device_t:chr_file { getattr read };
+allow $1_dbusd_t self:file { getattr read };
+allow $1_dbusd_t proc_t:file { read };
+
+')dnl end dbusd_domain definition
+
+# dbusd_client(dbus_type, domain)
+# Example: dbusd_client_domain(system, user_t)
+#
+# Grant permissions for connecting to the specified DBus type
+# from domain.
+define(`dbusd_client',`')
+ifdef(`dbusd.te',`
+undefine(`dbusd_client')
+define(`dbusd_client',`
+# For connecting to the bus
+allow $2 $1_dbusd_t:unix_stream_socket { connectto };
+ifelse(`system', `$1', `
+allow { $2 } { var_run_t system_dbusd_var_run_t }:dir search;
+allow { $2 } system_dbusd_var_run_t:sock_file { write };
+',`
+') dnl endif system
+# SE-DBus specific permissions
+allow $2 { $1_dbusd_t self }:dbus { send_msg };
+') dnl endif dbusd.te
+')
diff --exclude-from=exclude -N -u -r nsapolicy/tunables/distro.tun policy-1.17.10/tunables/distro.tun
--- nsapolicy/tunables/distro.tun	2004-08-27 14:44:11.000000000 -0400
+++ policy-1.17.10/tunables/distro.tun	2004-09-07 15:54:49.326454326 -0400
@@ -5,7 +5,7 @@
 # appropriate ifdefs.
 
 
-dnl define(`distro_redhat')
+define(`distro_redhat')
 
 dnl define(`distro_suse')
 
diff --exclude-from=exclude -N -u -r nsapolicy/tunables/tunable.tun policy-1.17.10/tunables/tunable.tun
--- nsapolicy/tunables/tunable.tun	2004-08-27 14:44:11.000000000 -0400
+++ policy-1.17.10/tunables/tunable.tun	2004-09-07 15:54:49.327454228 -0400
@@ -5,50 +5,47 @@
 dnl define(`user_net_control')
 
 # Allow users to execute the mount command
-dnl define(`user_can_mount')
+define(`user_can_mount')
 
 # Allow rpm to run unconfined.
-dnl define(`unlimitedRPM')
+define(`unlimitedRPM')
 
 # Allow privileged utilities like hotplug and insmod to run unconfined.
-dnl define(`unlimitedUtils')
+define(`unlimitedUtils')
 
 # Support NFS home directories
-dnl define(`nfs_home_dirs')
+define(`nfs_home_dirs')
 
 # Allow users to run games
-dnl define(`use_games')
+define(`use_games')
 
 # Allow ypbind to run with NIS
-dnl define(`allow_ypbind')
+define(`allow_ypbind')
 
 # Allow rc scripts to run unconfined, including any daemon
 # started by an rc script that does not have a domain transition
 # explicitly defined.
-dnl define(`unlimitedRC')
+define(`unlimitedRC')
 
 # Allow sysadm_t to directly start daemons
 define(`direct_sysadm_daemon')
 
 # Do not audit things that we know to be broken but which
 # are not security risks
-dnl define(`hide_broken_symptoms')
+define(`hide_broken_symptoms')
 
 # Allow sysadm_t to do almost everything
 dnl define(`unrestricted_admin')
 
 # Allow the read/write/create on any NFS file system
-dnl define(`nfs_export_all_rw')
-
-# Allow users to unrestricted access
-dnl define(`unlimitedUsers')
+define(`nfs_export_all_rw')
 
 # Allow the reading on any NFS file system
 dnl define(`nfs_export_all_ro')
 
 # Allow user_r to reach sysadm_r via su, sudo, or userhelper.
 # Otherwise, only staff_r can do so.
-dnl define(`user_canbe_sysadm')
+define(`user_canbe_sysadm')
 
 # Allow xinetd to run unconfined, including any services it starts
 # that do not have a domain transition explicitly defined.
diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.17.10/types/file.te
--- nsapolicy/types/file.te	2004-08-30 09:49:16.000000000 -0400
+++ policy-1.17.10/types/file.te	2004-09-07 15:54:49.327454228 -0400
@@ -258,6 +258,7 @@
 # the default file system type.
 #
 allow { file_type device_type } fs_t:filesystem associate;
+allow { file_type device_type } tmpfs_t:filesystem associate;
 
 # Allow the pty to be associated with the file system.
 allow devpts_t devpts_t:filesystem associate;

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Patch to make udev/tmpfs work and changes from colin  walters for dbus.
  2004-09-07 20:45 Patch to make udev/tmpfs work and changes from colin walters for dbus Daniel J Walsh
@ 2004-09-08  0:00 ` Luke Kenneth Casson Leighton
  2004-09-08 12:17 ` Stephen Smalley
  2004-09-09 12:53 ` James Carter
  2 siblings, 0 replies; 10+ messages in thread
From: Luke Kenneth Casson Leighton @ 2004-09-08  0:00 UTC (permalink / raw)
  To: Daniel J Walsh; +Cc: Stephen Smalley, SELinux

On Tue, Sep 07, 2004 at 04:45:20PM -0400, Daniel J Walsh wrote:
> Adding
> 
> restorecon /dev /dev/null
> restorecon /dev/*

 yes, it does, doesn't it!

 that's why i wrote a little script called /sbin/restoredevicefiles
 and call it from at least two places in /etc/init.d scripts!!

 if you find that you don't need also to do restorecon /dev/*/*
 please let me know.

 also i notice from the policy patch that you haven't gotten
 around to using any of the tools listed in fsadm.te.

 l.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Patch to make udev/tmpfs work and changes from colin  walters for dbus.
  2004-09-07 20:45 Patch to make udev/tmpfs work and changes from colin walters for dbus Daniel J Walsh
  2004-09-08  0:00 ` Luke Kenneth Casson Leighton
@ 2004-09-08 12:17 ` Stephen Smalley
  2004-09-08 14:57   ` Daniel J Walsh
  2004-09-08 22:04   ` Luke Kenneth Casson Leighton
  2004-09-09 12:53 ` James Carter
  2 siblings, 2 replies; 10+ messages in thread
From: Stephen Smalley @ 2004-09-08 12:17 UTC (permalink / raw)
  To: Daniel J Walsh; +Cc: SELinux

On Tue, 2004-09-07 at 16:45, Daniel J Walsh wrote:
> Adding
> 
> restorecon /dev /dev/null
> restorecon /dev/*

Adding them where?  If you do this from /sbin/init immediately after the
initial policy load, then I would have expected that you wouldn't need
to insert tmpfs_t in as many places, as only init and restorecon would
then need to temporarily access /dev while it was still labeled tmpfs_t.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Patch to make udev/tmpfs work and changes from colin  walters for dbus.
  2004-09-08 12:17 ` Stephen Smalley
@ 2004-09-08 14:57   ` Daniel J Walsh
  2004-09-08 15:12     ` Stephen Smalley
  2004-09-08 22:04   ` Luke Kenneth Casson Leighton
  1 sibling, 1 reply; 10+ messages in thread
From: Daniel J Walsh @ 2004-09-08 14:57 UTC (permalink / raw)
  To: Stephen Smalley; +Cc: SELinux

Stephen Smalley wrote:

>On Tue, 2004-09-07 at 16:45, Daniel J Walsh wrote:
>  
>
>>Adding
>>
>>restorecon /dev /dev/null
>>restorecon /dev/*
>>    
>>
>
>Adding them where?  If you do this from /sbin/init immediately after the
>initial policy load, then I would have expected that you wouldn't need
>to insert tmpfs_t in as many places, as only init and restorecon would
>then need to temporarily access /dev while it was still labeled tmpfs_t.
>
>  
>
It is the fealing here to keep the init program as simple as possible 
for maintainability, bugs in it are very difficult to debug, so the
restorecon will remain in the rc.sysinit scripts.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Patch to make udev/tmpfs work and changes from colin  walters for dbus.
  2004-09-08 14:57   ` Daniel J Walsh
@ 2004-09-08 15:12     ` Stephen Smalley
  2004-09-08 15:35       ` Daniel J Walsh
  0 siblings, 1 reply; 10+ messages in thread
From: Stephen Smalley @ 2004-09-08 15:12 UTC (permalink / raw)
  To: Daniel J Walsh; +Cc: SELinux

On Wed, 2004-09-08 at 10:57, Daniel J Walsh wrote:
> It is the feeling here to keep the init program as simple as possible 
> for maintainability, bugs in it are very difficult to debug, so the
> restorecon will remain in the rc.sysinit scripts.

Is the patch for rc.sysinit available somewhere we can look at it?  You
want to apply restorecon as early as possible in it to minimize the set
of programs that access /dev before it has been restored.

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Patch to make udev/tmpfs work and changes from colin  walters for dbus.
  2004-09-08 15:12     ` Stephen Smalley
@ 2004-09-08 15:35       ` Daniel J Walsh
  0 siblings, 0 replies; 10+ messages in thread
From: Daniel J Walsh @ 2004-09-08 15:35 UTC (permalink / raw)
  To: Stephen Smalley; +Cc: SELinux

[-- Attachment #1: Type: text/plain, Size: 609 bytes --]

Stephen Smalley wrote:

>On Wed, 2004-09-08 at 10:57, Daniel J Walsh wrote:
>  
>
>>It is the feeling here to keep the init program as simple as possible 
>>for maintainability, bugs in it are very difficult to debug, so the
>>restorecon will remain in the rc.sysinit scripts.
>>    
>>
>
>Is the patch for rc.sysinit available somewhere we can look at it?  You
>want to apply restorecon as early as possible in it to minimize the set
>of programs that access /dev before it has been restored.
>
>  
>
The new initscripts package is out on my people page.
mount, hostname and init will need the privs.

Dan



[-- Attachment #2: rc.sysinit --]
[-- Type: text/plain, Size: 25985 bytes --]

#!/bin/bash
#
# /etc/rc.d/rc.sysinit - run once at boot time
#
# Taken in part from Miquel van Smoorenburg's bcheckrc.
#

# Rerun ourselves through initlog
if [ -z "$IN_INITLOG" -a -x /sbin/initlog ]; then
    exec /sbin/initlog -r /etc/rc.d/rc.sysinit
fi

HOSTNAME=`/bin/hostname`
HOSTTYPE=`uname -m`
unamer=`uname -r`
eval version=`echo $unamer | awk -F '.' '{ print "(" $1 " " $2 ")" }'`

if [ -f /etc/sysconfig/network ]; then
    . /etc/sysconfig/network
fi
if [ -z "$HOSTNAME" -o "$HOSTNAME" = "(none)" ]; then
    HOSTNAME=localhost
fi

# Mount /proc and /sys (done here so volume labels can work with fsck)
mount -n -t proc /proc /proc
mount -n -t usbfs /proc/bus/usb /proc/bus/usb
mount -n -t sysfs /sys /sys >/dev/null 2>&1

. /etc/init.d/functions

# Check SELinux status
selinuxfs=`awk '/ selinuxfs / { print $2 }' /proc/mounts`
SELINUX=
if [ -n "$selinuxfs" ] && [ "`cat /proc/self/attr/current`" != "kernel" ]; then
	if [ -r $selinuxfs/enforce ] ; then
		SELINUX=`cat $selinuxfs/enforce`
	else
		# assume enforcing if you can't read it
		SELINUX=1
	fi
fi

if [ "$SELINUX" = "1" -a -x /sbin/restorecon ] && fgrep -q " /dev " /proc/mounts ; then
	restorecon  /dev /dev/null
	restorecon  /dev/* 2> /dev/null
fi

disable_selinux() {
	echo "*** Warning -- SELinux is active"
	echo "*** Disabling security enforcement for system recovery."
	echo "*** Run 'setenforce 1' to reenable."
	echo "0" > $selinuxfs/enforce
}

relabel_selinux() {
    if [ -x /usr/bin/rhgb-client ] && /usr/bin/rhgb-client --ping ; then
	chvt 1
    fi
    echo "
         *** Warning -- SELinux relabel is required. ***
	 *** Disabling security enforcement.         ***
	 *** Relabeling could take a very long time, ***
	 *** depending on file system size.          ***
	 "
    echo "0" > $selinuxfs/enforce
    mount -n -o remount,rw /
    mount -a
    /sbin/fixfiles -F relabel > /dev/null 2>&1 
    rm -f  /.autorelabel 
    mount -n -o remount,ro /
    umount -a
    echo "*** Enabling security enforcement.         ***"
    echo $SELINUX > $selinuxfs/enforce
}



if [ "$HOSTTYPE" != "s390" -a "$HOSTTYPE" != "s390x" ]; then
  last=0
  for i in `LC_ALL=C grep '^[0-9].*respawn:/sbin/mingetty' /etc/inittab | sed 's/^.* tty\([0-9][0-9]*\).*/\1/g'`; do
        > /dev/tty$i
        last=$i
  done
  if [ $last -gt 0 ]; then
       > /dev/tty$((last+1))
       > /dev/tty$((last+2))
  fi
fi

if [ "$CONSOLETYPE" = "vt" -a -x /sbin/setsysfont ]; then
   echo -n "Setting default font ($SYSFONT): "
   /sbin/setsysfont
   if [ $? -eq 0 ]; then
      success
   else
      failure
   fi
   echo ; echo
fi

# Print a text banner.
echo -en $"\t\tWelcome to "
if LC_ALL=C fgrep -q "Red Hat" /etc/redhat-release ; then 
 [ "$BOOTUP" = "color" ] && echo -en "\\033[0;31m"
 echo -en "Red Hat"
 [ "$BOOTUP" = "color" ] && echo -en "\\033[0;39m"
 PRODUCT=`sed "s/Red Hat \(.*\) release.*/\1/" /etc/redhat-release`
 echo " $PRODUCT"
elif LC_ALL=C fgrep -q "Fedora" /etc/redhat-release ; then 
 [ "$BOOTUP" = "color" ] && echo -en "\\033[0;31m"
 echo -en "Fedora"
 [ "$BOOTUP" = "color" ] && echo -en "\\033[0;39m"
 PRODUCT=`sed "s/Fedora \(.*\) release.*/\1/" /etc/redhat-release`
 echo " $PRODUCT"
else
 PRODUCT=`sed "s/ release.*//g" /etc/redhat-release`
 echo "$PRODUCT"
fi
if [ "$PROMPT" != "no" ]; then
 echo -en $"\t\tPress 'I' to enter interactive startup."
 echo
fi

# Fix console loglevel
if [ -n "$LOGLEVEL" ]; then
	/bin/dmesg -n $LOGLEVEL
fi

if [ -f /etc/udev/udev.conf ];then
	. /etc/udev/udev.conf
fi

if [ "$USE_UDEV" = "yes" -a "$UDEV_TMPFS" = "yes" ]; then
	[ -x /sbin/start_udev ] && /sbin/start_udev
fi

# Initialize hardware
if [ -f /proc/sys/kernel/modprobe ]; then
   if ! strstr cmdline nomodules && [ -f /proc/modules ] ; then
       sysctl -w kernel.modprobe="/sbin/modprobe" >/dev/null 2>&1
       sysctl -w kernel.hotplug="/sbin/hotplug" >/dev/null 2>&1
   else
       # We used to set this to NULL, but that causes 'failed to exec' messages"
       sysctl -w kernel.modprobe="/bin/true" >/dev/null 2>&1
       sysctl -w kernel.hotplug="/bin/true" >/dev/null 2>&1
   fi
fi

echo -n $"Initializing hardware... "

ide=""
scsi=""
network=""
audio=""
other=""
eval `kmodule | while read devtype mod ; do
	case "$devtype" in
		"IDE")	ide="$ide $mod"
		   echo "ide=\"$ide"\";;
		"SCSI") scsi="$scsi $mod"
		   echo "scsi=\"$scsi"\";;
		"NETWORK") network="$network $mod"
		   echo "network=\"$network"\";;
		"AUDIO") audio="$audio $mod"
		   echo "audio=\"$audio"\";;
		*) other="$other $mod"
		   echo "other=\"$other"\";;
	esac
done`

# IDE
for module in $ide ; do
	modprobe $module >/dev/null 2>&1
done

# SCSI
for module in `/sbin/modprobe -c | awk '/^alias[[:space:]]+scsi_hostadapter[[:space:]]/ { print $3 }'` $scsi; do
	modprobe $module >/dev/null 2>&1
done
modprobe floppy >/dev/null 2>&1

echo -n $" storage"

# Network
pushd /etc/sysconfig/network-scripts >/dev/null 2>&1
interfaces=`ls ifcfg* | LANG=C egrep -v '(ifcfg-lo|:|rpmsave|rpmorig|rpmnew)' | \
            LANG=C egrep -v '(~|\.bak)$' | \
            LANG=C egrep 'ifcfg-[A-Za-z0-9\._-]+$' | \
	    sed 's/^ifcfg-//g' |
	    sed 's/[0-9]/ &/' | LANG=C sort -k 1,1 -k 2n | sed 's/ //'`

for i in $interfaces ; do
	eval $(LANG=C fgrep "DEVICE=" ifcfg-$i)
	modprobe $DEVICE >/dev/null 2>&1
done
popd >/dev/null 2>&1

for module in $network ; do
	modprobe $module >/dev/null 2>&1
done

echo -n $" network"

# Sound
for module in `/sbin/modprobe -c | awk '/^alias[[:space:]]+snd-card-[[:digit:]]+[[:space:]]/ { print $3 }'` $audio; do
	modprobe $module >/dev/null 2>&1
done

echo -n $" audio"

# Everything else (duck and cover)
for module in $other ; do
	modprobe $module >/dev/null 2>&1
done

echo -n $" done"
success
echo

echo "raidautorun /dev/md0" | nash --quiet

# Start the graphical boot, if necessary; /usr may not be mounted yet, so we
# may have to do this again after mounting
RHGB_STARTED=0
mount -n /dev/pts

if fgrep rhgb /proc/cmdline > /dev/null 2>&1 && [ "$BOOTUP" = "color" -a "$GRAPHICAL" = "yes" -a -x /usr/bin/rhgb ]; then
   LC_MESSAGES= /usr/bin/rhgb
   RHGB_STARTED=1
fi

# Configure kernel parameters
update_boot_stage RCkernelparam
action $"Configuring kernel parameters: " sysctl -e -p /etc/sysctl.conf

# Set the system clock.
update_boot_stage RCclock
ARC=0
SRM=0
UTC=0

if [ -f /etc/sysconfig/clock ]; then
   . /etc/sysconfig/clock

   # convert old style clock config to new values
   if [ "${CLOCKMODE}" = "GMT" ]; then
      UTC=true
   elif [ "${CLOCKMODE}" = "ARC" ]; then
      ARC=true
   fi
fi

CLOCKDEF=""
CLOCKFLAGS="$CLOCKFLAGS --hctosys"

case "$UTC" in
    yes|true)	CLOCKFLAGS="$CLOCKFLAGS --utc"
		CLOCKDEF="$CLOCKDEF (utc)" ;;
    no|false)	CLOCKFLAGS="$CLOCKFLAGS --localtime"
		CLOCKDEF="$CLOCKDEF (localtime)" ;;
esac
case "$ARC" in
    yes|true)	CLOCKFLAGS="$CLOCKFLAGS --arc"
		CLOCKDEF="$CLOCKDEF (arc)" ;;
esac
case "$SRM" in
    yes|true)	CLOCKFLAGS="$CLOCKFLAGS --srm"
		CLOCKDEF="$CLOCKDEF (srm)" ;;
esac

/sbin/hwclock $CLOCKFLAGS

action $"Setting clock $CLOCKDEF: `date`" date

if [ "$CONSOLETYPE" = "vt" -a -x /bin/loadkeys ]; then
 KEYTABLE=
 KEYMAP=
 if [ -f /etc/sysconfig/console/default.kmap ]; then
  KEYMAP=/etc/sysconfig/console/default.kmap
 else
  if [ -f /etc/sysconfig/keyboard ]; then
    . /etc/sysconfig/keyboard
  fi
  if [ -n "$KEYTABLE" -a -d "/lib/kbd/keymaps" ]; then
     KEYMAP="$KEYTABLE.map"
  fi
 fi
 if [ -n "$KEYMAP" ]; then 
  # Since this takes in/output from stdin/out, we can't use initlog
  if [ -n "$KEYTABLE" ]; then
    echo -n $"Loading default keymap ($KEYTABLE): "
  else
    echo -n $"Loading default keymap: "
  fi
  loadkeys $KEYMAP < /dev/tty0 > /dev/tty0 2>/dev/null && \
     success $"Loading default keymap" || failure $"Loading default keymap"
  echo
 fi
fi

# Set the hostname.
update_boot_stage RChostname
action $"Setting hostname ${HOSTNAME}: " hostname ${HOSTNAME}

# Only read this once.
cmdline=$(cat /proc/cmdline)

# Initialiaze ACPI bits
if [ -d /proc/acpi ]; then
   for module in /lib/modules/$unamer/kernel/drivers/acpi/* ; do
      insmod $module >/dev/null 2>&1
   done
fi

if [ -f /fastboot ] || strstr "$cmdline" fastboot ; then
	fastboot=yes
fi

if [ -f /fsckoptions ]; then
	fsckoptions=`cat /fsckoptions`
fi

if [ -f /forcefsck ] || strstr "$cmdline" forcefsck ; then
	fsckoptions="-f $fsckoptions"
elif [ -f /.autofsck ]; then
        if [ -x /usr/bin/rhgb-client ] && /usr/bin/rhgb-client --ping ; then
	     chvt 1
	fi
	echo $"Your system appears to have shut down uncleanly"
	AUTOFSCK_TIMEOUT=5
	[ -f /etc/sysconfig/autofsck ] && . /etc/sysconfig/autofsck
	if [ "$AUTOFSCK_DEF_CHECK" = "yes" ]; then
		AUTOFSCK_OPT=-f
	fi

	if [ "$PROMPT" != "no" ]; then
		if [ "$AUTOFSCK_DEF_CHECK" = "yes" ]; then
			if /sbin/getkey -c $AUTOFSCK_TIMEOUT -m $"Press N within %d seconds to not force file system integrity check..." n ; then
				AUTOFSCK_OPT=
			fi
		else
			if /sbin/getkey -c $AUTOFSCK_TIMEOUT -m $"Press Y within %d seconds to force file system integrity check..." y ; then
				AUTOFSCK_OPT=-f
			fi
		fi
		echo
	else
		# PROMPT not allowed
		if [ "$AUTOFSCK_DEF_CHECK" = "yes" ]; then
			echo $"Forcing file system integrity check due to default setting"
		else
			echo $"Not forcing file system integrity check due to default setting"
		fi
	fi
	fsckoptions="$AUTOFSCK_OPT $fsckoptions"
fi

if [ "$BOOTUP" = "color" ]; then
	fsckoptions="-C $fsckoptions"
else
	fsckoptions="-V $fsckoptions"
fi

if [ -f /etc/sysconfig/readonly-root ]; then
    . /etc/sysconfig/readonly-root

    if [ "$READONLY" = "yes" ]; then
        # Call rc.readonly to set up magic stuff needed for readonly root
        . /etc/rc.readonly
    fi
fi
 
_RUN_QUOTACHECK=0
ROOTFSTYPE=`awk '/ \/ / && ($3 !~ /rootfs/) { print $3 }' /proc/mounts`
if [ -z "$fastboot" -a "$READONLY" != "yes" -a "X$ROOTFSTYPE" != "Xnfs" -a "X$ROOTFSTYPE" != "Xnfs4" ]; then 

        STRING=$"Checking root filesystem"
	echo $STRING
	rootdev=`awk '/ \/ / && ($3 !~ /rootfs/) {print $1}' /proc/mounts`
	if [ -b /initrd/"$rootdev" ] ; then
		rootdev=/initrd/"$rootdev"
	else
		rootdev=/
	fi
	initlog -c "fsck -T -a $rootdev $fsckoptions"
	rc=$?
	
	if [ "$rc" -eq "0" ]; then
		success "$STRING"
		echo
	elif [ "$rc" -eq "1" ]; then
	        passed "$STRING"
		echo
        fi
	
        # A return of 2 or higher means there were serious problems.
	if [ $rc -gt 1 ]; then
	        if [ -x /usr/bin/rhgb-client ] && /usr/bin/rhgb-client --ping ; then
		    chvt 1
		fi

		failure "$STRING"
		echo
		echo
		echo $"*** An error occurred during the file system check."
		echo $"*** Dropping you to a shell; the system will reboot"
		echo $"*** when you leave the shell."

                str=$"(Repair filesystem)"
		PS1="$str \# # "; export PS1
		[ "$SELINUX" = "1" ] && disable_selinux
		sulogin

		echo $"Unmounting file systems"
		umount -a
		mount -n -o remount,ro /
		echo $"Automatic reboot in progress."
		reboot -f
	elif [ "$rc" -eq "1" ]; then
		_RUN_QUOTACHECK=1
	fi
fi
#
# Check to see if SELinux requires a relabel
#
[ -n "$SELINUX" ] && [ -f /.autorelabel ] && relabel_selinux

# Unmount the initrd, if necessary
if LC_ALL=C fgrep -q /initrd /proc/mounts && ! LC_ALL=C fgrep -q /initrd/loopfs /proc/mounts ; then
   if [ -e /initrd/dev/.devfsd ]; then
      umount /initrd/dev
   fi
   umount /initrd
   /sbin/blockdev --flushbufs /dev/ram0 >/dev/null 2>&1
fi
                                                                                
# Possibly update quotas if fsck was run on /.
LC_ALL=C grep -E '[[:space:]]+/[[:space:]]+' /etc/fstab | \
    awk '{ print $4 }' | \
    LC_ALL=C fgrep -q quota
_ROOT_HAS_QUOTA=$?
if [ "X$_RUN_QUOTACHECK" = "X1" -a \
    "X$_ROOT_HAS_QUOTA" = "X0" -a \
    -x /sbin/quotacheck ]; then
	if [ -x /sbin/convertquota ]; then
	    if [ -f /quota.user ]; then
		action $"Converting old user quota files: " \
		    /sbin/convertquota -u / && rm -f /quota.user
	    fi
	    if [ -f /quota.group ]; then
		action $"Converting old group quota files: " \
		    /sbin/convertquota -g / && rm -f /quota.group
	    fi
	fi
	action $"Checking root filesystem quotas: " /sbin/quotacheck -nug /
fi

if [ -x /sbin/isapnp -a -f /etc/isapnp.conf -a ! -f /proc/isapnp ]; then
    # check for arguments passed from kernel
    if ! strstr "$cmdline" nopnp ; then
	PNP=yes
    fi
    if [ -n "$PNP" ]; then
	action $"Setting up ISA PNP devices: " /sbin/isapnp /etc/isapnp.conf
    else
	action $"Skipping ISA PNP configuration at users request: " /bin/true
    fi
fi

# Remount the root filesystem read-write.
update_boot_stage RCmountfs
state=`awk '/ \/ / && ($3 !~ /rootfs/) { print $4 }' /proc/mounts`
[ "$state" != "rw" -a "$READONLY" != "yes" ] && \
  action $"Remounting root filesystem in read-write mode: " mount -n -o remount,rw /

if [ "$USE_UDEV" = "yes" -a "$UDEV_TMPFS" = "no" ]; then
	[ -x /sbin/start_udev ] && /sbin/start_udev
fi


# LVM2 initialization
if [ -x /sbin/lvm.static ]; then
    if ! LC_ALL=C fgrep -q "device-mapper" /proc/devices 2>/dev/null ; then
	modprobe dm-mod >/dev/null 2>&1
    fi
    echo "mkdmnod" | /sbin/nash --quiet >/dev/null 2>&1
    [ -n "$SELINUX" ] && restorecon /dev/mapper/control >/dev/null 2>&1
    if [ -c /dev/mapper/control -a -x /sbin/lvm.static ]; then
	if /sbin/lvm.static vgscan --mknodes --ignorelockingfailure > /dev/null 2>&1 ; then
	    action $"Setting up Logical Volume Management:" /sbin/lvm.static vgchange -a y --ignorelockingfailure
	fi
    fi
fi
# LVM initialization
if [ -f /etc/lvmtab ]; then
    [ -e /proc/lvm ] || modprobe lvm-mod > /dev/null 2>&1
    if [ -e /proc/lvm -a -x /sbin/vgchange ]; then
	action $"Setting up Logical Volume Management:" /sbin/vgscan && /sbin/vgchange -a y
    fi
fi

# Clean up SELinux labels
if [ -n "$SELINUX" ]; then
   for file in /etc/mtab /etc/ld.so.cache ; do
   	[ -r $file ] && restorecon $file  >/dev/null 2>&1
   done
fi

# Clear mtab
(> /etc/mtab) &> /dev/null

# Remove stale backups
rm -f /etc/mtab~ /etc/mtab~~

# Enter root, /proc and (potentially) /proc/bus/usb and devfs into mtab.
mount -f /
mount -f /proc
mount -f /sys >/dev/null 2>&1
mount -f /dev/pts
[ -f /proc/bus/usb/devices ] && mount -f -t usbdevfs usbdevfs /proc/bus/usb
[ -e /dev/.devfsd ] && mount -f -t devfs devfs /dev 

# configure all zfcp (scsi over fibrechannel) devices before trying to mount them
# zfcpconf.sh exists only on mainframe
[ -x /sbin/zfcpconf.sh ] && /sbin/zfcpconf.sh

# The root filesystem is now read-write, so we can now log
# via syslog() directly..
if [ -n "$IN_INITLOG" ]; then
    IN_INITLOG=
fi

if ! strstr "$cmdline" nomodules && [ -f /proc/modules ] ; then
    USEMODULES=y
fi

# Load modules (for backward compatibility with VARs)
if [ -f /etc/rc.modules ]; then
	/etc/rc.modules
fi

update_boot_stage RCraid
if [ -f /etc/raidtab ]; then
    # Add raid devices
    [ -f /proc/mdstat ] || modprobe md >/dev/null 2>&1

    if [ -f /proc/mdstat ]; then
	echo -n $"Starting up RAID devices: " 

	rc=0
	
	for i in `awk '{if ($1=="raiddev") print $2}' /etc/raidtab`
	do
		RAIDDEV=`basename $i`
                RAIDSTAT=`LC_ALL=C grep "^$RAIDDEV : active" /proc/mdstat`
		if [ -z "$RAIDSTAT" ]; then
			# First scan the /etc/fstab for the "noauto"-flag
			# for this device. If found, skip the initialization
			# for it to avoid dropping to a shell on errors.
			# If not, try raidstart...if that fails then
			# fall back to raidadd, raidrun.  If that
			# also fails, then we drop to a shell
			RESULT=1
			INFSTAB=`LC_ALL=C grep -c "^$i" /etc/fstab`
			if [ $INFSTAB -eq 0 ] ; then
			    RESULT=0
			    RAIDDEV="$RAIDDEV(skipped)"
			fi
			NOAUTO=`LC_ALL=C grep "^$i" /etc/fstab | LC_ALL=C fgrep -c "noauto"`
			if [ $NOAUTO -gt 0 ]; then
			    RESULT=0
			    RAIDDEV="$RAIDDEV(skipped)"
			fi
			if [ $RESULT -gt 0 -a -x /sbin/raidstart ]; then
				/sbin/raidstart $i
				RESULT=$?
			fi
			if [ $RESULT -gt 0 -a -x /sbin/raid0run ]; then
				/sbin/raid0run $i
				RESULT=$?
			fi
			if [ $RESULT -gt 0 -a -x /sbin/raidadd -a -x /sbin/raidrun ]; then
				/sbin/raidadd $i
				/sbin/raidrun $i
				RESULT=$?
			fi
			if [ $RESULT -gt 0 ]; then
				rc=1
			fi
			echo -n "$RAIDDEV "
		else
			echo -n "$RAIDDEV "
		fi
	done
	echo

	# A non-zero return means there were problems.
	if [ $rc -gt 0 ]; then
	        if [ -x /usr/bin/rhgb-client ] && /usr/bin/rhgb-client --ping ; then
		    chvt 1
		fi
		echo
		echo
		echo $"*** An error occurred during the RAID startup"
		echo $"*** Dropping you to a shell; the system will reboot"
		echo $"*** when you leave the shell."

 		str=$"(RAID Repair)"
		PS1="$str \# # "; export PS1
		[ "$SELINUX" = "1" ] && disable_selinux
		sulogin

		echo $"Unmounting file systems"
		umount -a
		mount -n -o remount,ro /
		echo $"Automatic reboot in progress."
		reboot -f
	fi
	# LVM2 initialization, take 2
	if [ -c /dev/mapper/control -a -x /sbin/lvm.static ]; then
		if /sbin/lvm.static vgscan > /dev/null 2>&1 ; then 
			action $"Setting up Logical Volume Management:" /sbin/lvm.static vgscan --mknodes --ignorelockingfailure && /sbin/lvm.static vgchange -a y --ignorelockingfailure
		fi
	fi
	# LVM initialization, take 2 (it could be on top of RAID)
	if [ -e /proc/lvm -a -x /sbin/vgchange -a -f /etc/lvmtab ]; then
		action $"Setting up Logical Volume Management:" /sbin/vgscan && /sbin/vgchange -a y
	fi
    fi
fi

if [ -x /sbin/devlabel ]; then
	/sbin/devlabel restart
fi

_RUN_QUOTACHECK=0
# Check filesystems
if [ -z "$fastboot" ]; then
        STRING=$"Checking filesystems"
	echo $STRING
	initlog -c "fsck -T -R -A -a $fsckoptions"
	rc=$?
        if [ "$rc" -eq "0" ]; then
		success "$STRING"
		echo
	elif [ "$rc" -eq "1" ]; then
	        passed "$STRING"
		echo
	fi

	# A return of 2 or higher means there were serious problems.
	if [ $rc -gt 1 ]; then
	        if [ -x /usr/bin/rhgb-client ] && /usr/bin/rhgb-client --ping ; then
		    chvt 1
		fi

	        failure "$STRING"
		echo
		echo
		echo $"*** An error occurred during the file system check."
		echo $"*** Dropping you to a shell; the system will reboot"
		echo $"*** when you leave the shell."

		str=$"(Repair filesystem)"
		PS1="$str \# # "; export PS1
		[ "$SELINUX" = "1" ] && disable_selinux
		sulogin

		echo $"Unmounting file systems"
		umount -a
		mount -n -o remount,ro /
		echo $"Automatic reboot in progress."
		reboot -f
	elif [ "$rc" -eq "1" -a -x /sbin/quotacheck ]; then
		_RUN_QUOTACHECK=1
	fi
fi

# Mount all other filesystems (except for NFS and /proc, which is already
# mounted). Contrary to standard usage,
# filesystems are NOT unmounted in single user mode.
action $"Mounting local filesystems: " mount -a -t nonfs,nfs4,smbfs,ncpfs,cifs,gfs -O no_netdev

# Start the graphical boot, if necessary and not done yet.
if fgrep rhgb /proc/cmdline > /dev/null 2>&1 && [ "$RHGB_STARTED" -eq 0 -a "$BOOTUP" = "color" -a "$GRAPHICAL" = "yes" -a -x /usr/bin/rhgb ]; then
   LC_MESSAGES= /usr/bin/rhgb
   RHGB_STARTED=1
fi

# check remaining quotas other than root
if [ X"$_RUN_QUOTACHECK" = X1 -a -x /sbin/quotacheck ]; then
	if [ -x /sbin/convertquota ]; then
	    # try to convert old quotas
	    for mountpt in `awk '$4 ~ /quota/{print $2}' /etc/mtab` ; do
		if [ -f "$mountpt/quota.user" ]; then
		    action $"Converting old user quota files: " \
		    /sbin/convertquota -u $mountpt && \
			rm -f $mountpt/quota.user
		fi
		if [ -f "$mountpt/quota.group" ]; then
		    action $"Converting old group quota files: " \
		    /sbin/convertquota -g $mountpt && \
			rm -f $mountpt/quota.group
		fi
	    done
	fi
	action $"Checking local filesystem quotas: " /sbin/quotacheck -aRnug
fi

if [ -x /sbin/quotaon ]; then
    action $"Enabling local filesystem quotas: " /sbin/quotaon -aug
fi

# Initialize pseudo-random number generator
if [ -f "/var/lib/random-seed" ]; then
	cat /var/lib/random-seed > /dev/urandom
else
	touch /var/lib/random-seed
fi
chmod 600 /var/lib/random-seed
dd if=/dev/urandom of=/var/lib/random-seed count=1 bs=512 2>/dev/null

# Use the hardware RNG to seed the entropy pool, if available
[ -x /sbin/rngd -a -f /dev/hw_random ] && rngd

# Configure machine if necessary.
if [ -f /.unconfigured ]; then
    if [ -x /usr/bin/rhgb-client ] && /usr/bin/rhgb-client --ping ; then
	chvt 1
    fi

    if [ -x /usr/sbin/kbdconfig ]; then
	/usr/sbin/kbdconfig
    fi
    if [ -x /usr/bin/passwd ]; then 
        /usr/bin/passwd root
    fi
    if [ -x /usr/sbin/netconfig ]; then
	/usr/sbin/netconfig
    fi
    if [ -x /usr/sbin/timeconfig ]; then
	/usr/sbin/timeconfig
    fi
    if [ -x /usr/sbin/authconfig ]; then
	/usr/sbin/authconfig --nostart
    fi
    if [ -x /usr/sbin/ntsysv ]; then
	/usr/sbin/ntsysv --level 35
    fi

    # Reread in network configuration data.
    if [ -f /etc/sysconfig/network ]; then
	. /etc/sysconfig/network

	# Reset the hostname.
	action $"Resetting hostname ${HOSTNAME}: " hostname ${HOSTNAME}
    fi

    rm -f /.unconfigured

    if [ -x /usr/bin/rhgb-client ] && /usr/bin/rhgb-client --ping ; then
	chvt 8
    fi
fi

# Clean out /.
rm -f /fastboot /fsckoptions /forcefsck /.autofsck /halt /poweroff &> /dev/null

# Do we need (w|u)tmpx files? We don't set them up, but the sysadmin might...
_NEED_XFILES=
[ -f /var/run/utmpx -o -f /var/log/wtmpx ] && _NEED_XFILES=1

# Clean up /var.  I'd use find, but /usr may not be mounted.
for afile in /var/lock/* /var/run/* ; do
	if [ -d "$afile" ]; then
	   case "$afile" in
		*/news|*/mon)	;;
		*/sudo)		rm -f $afile/*/* ;;
		*/vmware)	rm -rf $afile/*/* ;;
		*/samba)	rm -rf $afile/*/* ;;
		*)		rm -f $afile/* ;;
	   esac
	else
	   rm -f $afile
	fi
done
rm -f /var/lib/rpm/__db* &> /dev/null

# Reset pam_console permissions
[ -x /sbin/pam_console_apply ] && /sbin/pam_console_apply -r

{
# Clean up utmp/wtmp
> /var/run/utmp
touch /var/log/wtmp
chgrp utmp /var/run/utmp /var/log/wtmp
chmod 0664 /var/run/utmp /var/log/wtmp
if [ -n "$_NEED_XFILES" ]; then
  > /var/run/utmpx
  touch /var/log/wtmpx
  chgrp utmp /var/run/utmpx /var/log/wtmpx
  chmod 0664 /var/run/utmpx /var/log/wtmpx
fi

# Clean up various /tmp bits
rm -f /tmp/.X*-lock /tmp/.lock.* /tmp/.gdm_socket /tmp/.s.PGSQL.*
rm -rf /tmp/.X*-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/hsperfdata_* \
       /tmp/kde-* /tmp/ksocket-* /tmp/mc-* /tmp/mcop-* /tmp/orbit-*  \
       /tmp/scrollkeeper-*  /tmp/ssh-*
# Make ICE directory
mkdir -m 1777 -p /tmp/.ICE-unix >/dev/null 2>&1
chown root:root /tmp/.ICE-unix
[ -n "$SELINUX" ] && restorecon /tmp/.ICE-unix >/dev/null 2>&1

# Start up swapping.
update_boot_stage RCswap
action $"Enabling swap space: " swapon -a -e

# Set up binfmt_misc
/bin/mount -t binfmt_misc none /proc/sys/fs/binfmt_misc > /dev/null 2>&1

# Initialize the serial ports.
if [ -f /etc/rc.serial ]; then
	. /etc/rc.serial
fi

# If they asked for ide-scsi, load it
if strstr "$cmdline" ide-scsi ; then
	modprobe ide-cd >/dev/null 2>&1
	modprobe ide-scsi >/dev/null 2>&1
fi

# Turn on harddisk optimization
# There is only one file /etc/sysconfig/harddisks for all disks
# after installing the hdparm-RPM. If you need different hdparm parameters
# for each of your disks, copy /etc/sysconfig/harddisks to
# /etc/sysconfig/harddiskhda (hdb, hdc...) and modify it.
# Each disk which has no special parameters will use the defaults.
# Each non-disk which has no special parameters will be ignored.
# 
 
disk[0]=s;
disk[1]=hda;  disk[2]=hdb;  disk[3]=hdc;  disk[4]=hdd;
disk[5]=hde;  disk[6]=hdf;  disk[7]=hdg;  disk[8]=hdh;
disk[9]=hdi;  disk[10]=hdj; disk[11]=hdk; disk[12]=hdl;
disk[13]=hdm; disk[14]=hdn; disk[15]=hdo; disk[16]=hdp;
disk[17]=hdq; disk[18]=hdr; disk[19]=hds; disk[20]=hdt;
 
 
if [ -x /sbin/hdparm ]; then
   for device in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20; do
	unset MULTIPLE_IO USE_DMA EIDE_32BIT LOOKAHEAD EXTRA_PARAMS
        if [ -f /etc/sysconfig/harddisk${disk[$device]} ]; then
                . /etc/sysconfig/harddisk${disk[$device]}
                HDFLAGS[$device]=
                if [ -n "$MULTIPLE_IO" ]; then
                    HDFLAGS[$device]="-q -m$MULTIPLE_IO"
                fi
                if [ -n "$USE_DMA" ]; then
                    HDFLAGS[$device]="${HDFLAGS[$device]} -q -d$USE_DMA"
                fi
                if [ -n "$EIDE_32BIT" ]; then
                    HDFLAGS[$device]="${HDFLAGS[$device]} -q -c$EIDE_32BIT"
                fi
                if [ -n "$LOOKAHEAD" ]; then
                    HDFLAGS[$device]="${HDFLAGS[$device]} -q -A$LOOKAHEAD"
                fi
                if [ -n "$EXTRA_PARAMS" ]; then
                    HDFLAGS[$device]="${HDFLAGS[$device]} $EXTRA_PARAMS"
                fi
        else
                HDFLAGS[$device]="${HDFLAGS[0]}"
        fi
        if [ -e "/proc/ide/${disk[$device]}/media" ]; then
             hdmedia=`cat /proc/ide/${disk[$device]}/media`
             if [ "$hdmedia" = "disk" -o -f "/etc/sysconfig/harddisk${disk[$device]}" ]; then
                  if [ -n "${HDFLAGS[$device]}" ]; then
                      action $"Setting hard drive parameters for ${disk[$device]}: "  /sbin/hdparm ${HDFLAGS[$device]} /dev/${disk[$device]}
                  fi
             fi
        fi
   done
fi

# Boot time profiles. Yes, this should be somewhere else.
if [ -x /usr/sbin/system-config-network-cmd ]; then
  if strstr "$cmdline" netprofile= ; then
    for arg in $cmdline ; do
        if [ "${arg##netprofile=}" != "${arg}" ]; then
	    /usr/sbin/system-config-network-cmd --profile ${arg##netprofile=}
        fi
    done
  fi
fi

# Now that we have all of our basic modules loaded and the kernel going,
# let's dump the syslog ring somewhere so we can find it later
dmesg -s 131072 > /var/log/dmesg

# create the crash indicator flag to warn on crashes, offer fsck with timeout
touch /.autofsck &> /dev/null

kill -TERM `/sbin/pidof getkey` >/dev/null 2>&1
} &
if strstr "$cmdline" confirm ; then
	touch /var/run/confirm
fi
if [ "$PROMPT" != "no" ]; then
	/sbin/getkey i && touch /var/run/confirm
fi
wait

# Let rhgb know that we're leaving rc.sysinit
if [ -x /usr/bin/rhgb-client ] && /usr/bin/rhgb-client --ping ; then
    /usr/bin/rhgb-client --sysinit
fi


^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Patch to make udev/tmpfs work and changes from colin  walters for dbus.
  2004-09-08 12:17 ` Stephen Smalley
  2004-09-08 14:57   ` Daniel J Walsh
@ 2004-09-08 22:04   ` Luke Kenneth Casson Leighton
  1 sibling, 0 replies; 10+ messages in thread
From: Luke Kenneth Casson Leighton @ 2004-09-08 22:04 UTC (permalink / raw)
  To: Stephen Smalley; +Cc: Daniel J Walsh, SELinux

On Wed, Sep 08, 2004 at 08:17:05AM -0400, Stephen Smalley wrote:
> On Tue, 2004-09-07 at 16:45, Daniel J Walsh wrote:
> > Adding
> > 
> > restorecon /dev /dev/null
> > restorecon /dev/*
> 
> Adding them where?  If you do this from /sbin/init immediately after the
> initial policy load, 

 oh.
 
 that's a good idea.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Patch to make udev/tmpfs work and changes from colin  walters for dbus.
  2004-09-07 20:45 Patch to make udev/tmpfs work and changes from colin walters for dbus Daniel J Walsh
  2004-09-08  0:00 ` Luke Kenneth Casson Leighton
  2004-09-08 12:17 ` Stephen Smalley
@ 2004-09-09 12:53 ` James Carter
  2004-09-09 18:21   ` Colin Walters
  2 siblings, 1 reply; 10+ messages in thread
From: James Carter @ 2004-09-09 12:53 UTC (permalink / raw)
  To: Daniel J Walsh; +Cc: Stephen Smalley, SELinux

When I build the policy with this patch there is a conflict with two
type transitions.

Because of the alias rule:
typealias system_dbusd_exec_t alias dbusd_exec_t;

The following type transitions conflict:
type_transition sysadm_t dbusd_exec_t:process sysadm_dbusd_t;
type_transition sysadm_t system_dbusd_exec_t:process system_dbusd_t;

The second transition is the one used when I build the policy.  I am not
sure if that is the desired transition.


Where they come from:

type_transition sysadm_t dbusd_exec_t:process sysadm_dbusd_t;
	from dbusd_macros.te, line 24:
		domain_auto_trans($1_t, dbusd_exec_t, $1_dbusd_t)
	from base_user_macros.te, line 120: dbusd_domain($1)
	from admin_macros.te, line 30: base_user_domain($1)
	from admin.te, line 19: admin_domain(sysadm)

type_transition sysadm_t system_dbusd_exec_t:process system_dbusd_t;
	from global_macros.te, line 351: 
		domain_auto_trans(sysadm_t, $1_exec_t, $1_t)
	from dbusd_macros.te, line 12: 
		daemon_domain(system_dbusd, `, userspace_objmgr')
	from dbusd.te, line 5: dbusd_domain(system)

typealias system_dbusd_exec_t alias dbusd_exec_t;
	from dbusd_macros.te, line 15	

On Tue, 2004-09-07 at 16:45, Daniel J Walsh wrote:
> Adding
> 
> restorecon /dev /dev/null
> restorecon /dev/*
> 
> and the attached policy patch seems to clear up the problems with udev 
> and tmpfs.
> 
> Dan
> 
> ______________________________________________________________________
> diff --exclude-from=exclude -N -u -r nsapolicy/attrib.te policy-1.17.10/attrib.te
> --- nsapolicy/attrib.te	2004-09-01 14:00:01.000000000 -0400
> +++ policy-1.17.10/attrib.te	2004-09-07 15:55:15.049943838 -0400
> @@ -347,9 +347,6 @@
>  # For web clients such as netscape and squid
>  attribute web_client_domain;
>  
> -# For a dbus client
> -attribute dbus_client_domain;
> -
>  # For X Window System server domains
>  attribute xserver;
>  
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/hostname.te policy-1.17.10/domains/program/hostname.te
> --- nsapolicy/domains/program/hostname.te	2004-08-27 14:44:11.000000000 -0400
> +++ policy-1.17.10/domains/program/hostname.te	2004-09-07 15:56:44.609170450 -0400
> @@ -22,3 +22,4 @@
>  
>  # for when /usr is not mounted
>  dontaudit hostname_t file_t:dir search;
> +dontaudit hostname_t tmpfs_t:chr_file { read write };
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/init.te policy-1.17.10/domains/program/init.te
> --- nsapolicy/domains/program/init.te	2004-09-02 08:03:26.000000000 -0400
> +++ policy-1.17.10/domains/program/init.te	2004-09-07 15:56:26.230974473 -0400
> @@ -49,7 +49,7 @@
>  ')
>  
>  # Create /dev/initctl.
> -file_type_auto_trans(init_t, device_t, initctl_t, fifo_file)
> +file_type_auto_trans(init_t, { device_t tmpfs_t }, initctl_t, fifo_file)
>  
>  # Create ioctl.save.
>  file_type_auto_trans(init_t, etc_t, etc_runtime_t, file)
> @@ -114,8 +114,7 @@
>  can_setbool(init_t)
>  
>  # Read and write the console and ttys.
> -allow init_t console_device_t:chr_file rw_file_perms;
> -allow init_t tty_device_t:chr_file rw_file_perms;
> +allow init_t { tmpfs_t tty_device_t console_device_t } :chr_file rw_file_perms;
>  allow init_t ttyfile:chr_file rw_file_perms;
>  allow init_t ptyfile:chr_file rw_file_perms;
>  
> @@ -140,3 +139,5 @@
>  
>  # file descriptors inherited from the rootfs.
>  dontaudit init_t root_t:{ file chr_file } { read write }; 
> +
> +rw_dir_file(init_t, tmpfs_t)
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/restorecon.te policy-1.17.10/domains/program/restorecon.te
> --- nsapolicy/domains/program/restorecon.te	2004-08-27 14:44:11.000000000 -0400
> +++ policy-1.17.10/domains/program/restorecon.te	2004-09-07 15:57:33.287384531 -0400
> @@ -41,7 +41,9 @@
>  allow restorecon_t unlabeled_t:dir_file_class_set { getattr relabelfrom };
>  allow restorecon_t unlabeled_t:dir read;
>  allow restorecon_t device_type:{ chr_file blk_file } { getattr relabelfrom relabelto };
> -allow restorecon_t device_t:{ chr_file blk_file } { getattr relabelfrom };
> +allow restorecon_t { tmpfs_t device_t device_type }:{chr_file blk_file} { getattr relabelfrom relabelto };
> +allow restorecon_t tmpfs_t:{chr_file blk_file} { read write };
> +
>  allow restorecon_t ptyfile:chr_file getattr;
>  
>  allow restorecon_t fs_t:filesystem getattr;
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/bluetooth.te policy-1.17.10/domains/program/unused/bluetooth.te
> --- nsapolicy/domains/program/unused/bluetooth.te	2004-08-27 14:44:11.000000000 -0400
> +++ policy-1.17.10/domains/program/unused/bluetooth.te	2004-09-07 15:55:15.094939442 -0400
> @@ -8,7 +8,7 @@
>  #
>  # Rules for the bluetooth_t domain.
>  #
> -daemon_domain(bluetooth, `, dbus_client_domain')
> +daemon_domain(bluetooth)
>  
>  file_type_auto_trans(bluetooth_t, var_run_t, bluetooth_var_run_t, sock_file)
>  
> @@ -22,6 +22,7 @@
>  # Use the network.
>  can_network(bluetooth_t)
>  can_ypbind(bluetooth_t)
> +dbusd_client(system, bluetooth_t)
>  allow bluetooth_t self:socket { create setopt ioctl bind listen };
>  allow bluetooth_t self:unix_dgram_socket create_socket_perms;
>  allow bluetooth_t self:unix_stream_socket create_stream_socket_perms;
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/cups.te policy-1.17.10/domains/program/unused/cups.te
> --- nsapolicy/domains/program/unused/cups.te	2004-08-30 09:49:15.000000000 -0400
> +++ policy-1.17.10/domains/program/unused/cups.te	2004-09-07 15:55:15.138935145 -0400
> @@ -12,7 +12,7 @@
>  # cupsd_exec_t is the type of the cupsd executable.
>  #
>  type ipp_port_t, port_type;
> -daemon_domain(cupsd, `, auth_chkpwd, dbus_client_domain')
> +daemon_domain(cupsd, `, auth_chkpwd')
>  etcdir_domain(cupsd)
>  typealias cupsd_etc_t alias etc_cupsd_t;
>  type cupsd_rw_etc_t, file_type, sysadmfile, usercanread;
> @@ -20,6 +20,7 @@
>  
>  can_network(cupsd_t)
>  can_ypbind(cupsd_t)
> +dbusd_client(system, cupsd_t)
>  logdir_domain(cupsd)
>  
>  tmp_domain(cupsd)
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/dbusd.te policy-1.17.10/domains/program/unused/dbusd.te
> --- nsapolicy/domains/program/unused/dbusd.te	2004-09-01 14:00:02.000000000 -0400
> +++ policy-1.17.10/domains/program/unused/dbusd.te	2004-09-07 15:55:15.028945889 -0400
> @@ -2,34 +2,17 @@
>  #
>  # Author:  Russell Coker <russell@coker.com.au>
>  
> -daemon_domain(dbusd, `, userspace_objmgr')
> -type etc_dbusd_t, file_type, sysadmfile;
> +dbusd_domain(system)
>  
> -allow dbusd_t dbusd_var_run_t:sock_file create_file_perms;
> +allow system_dbusd_t dbusd_var_run_t:sock_file create_file_perms;
>  
>  ifdef(`pamconsole.te', `
> -r_dir_file(dbusd_t, pam_var_console_t)
> +r_dir_file(system_dbusd_t, pam_var_console_t)
>  ')
>  
> -r_dir_file(dbusd_t, etc_dbusd_t)
> -allow dbusd_t self:unix_stream_socket create_stream_socket_perms;
> -allow dbusd_t self:unix_dgram_socket create_socket_perms;
> -
> -allow dbusd_t etc_t:file { getattr read };
>  # dac_override: /var/run/dbus is owned by messagebus on Debian
> -allow dbusd_t self:capability { dac_override setgid setuid };
> -allow dbusd_t self:file { getattr read };
> -allow dbusd_t proc_t:file { read };
> -can_ypbind(dbusd_t)
> +allow system_dbusd_t self:capability { dac_override setgid setuid };
> +can_ypbind(system_dbusd_t)
>  
>  # I expect we need more than this
> -allow { dbus_client_domain userdomain } { var_run_t dbusd_var_run_t }:dir search;
> -allow { dbus_client_domain userdomain } dbusd_var_run_t:sock_file { write };
> -allow { dbus_client_domain userdomain } dbusd_t:unix_stream_socket { connectto };
> -
> -# Permissions for SE-DBus operation
> -r_dir_file(dbusd_t,selinux_config_t)
> -
> -# SE-DBus specific permissions
> -allow { dbus_client_domain userdomain } { dbusd_t self }:dbus { send_msg };
> -domain_auto_trans(userdomain, dbusd_exec_t, dbusd_t)
> +
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hald.te policy-1.17.10/domains/program/unused/hald.te
> --- nsapolicy/domains/program/unused/hald.te	2004-09-02 08:03:26.000000000 -0400
> +++ policy-1.17.10/domains/program/unused/hald.te	2004-09-07 15:55:15.183930749 -0400
> @@ -10,7 +10,7 @@
>  #
>  # hald_exec_t is the type of the hald executable.
>  #
> -daemon_domain(hald, `, dbus_client_domain, fs_domain')
> +daemon_domain(hald, `, fs_domain')
>  
>  can_exec(hald_t, hald_exec_t)
>  
> @@ -18,7 +18,7 @@
>  allow hald_t self:unix_stream_socket create_stream_socket_perms;
>  allow hald_t self:unix_dgram_socket create_socket_perms;
>  
> -allow hald_t dbusd_t:dbus { acquire_svc };
> +allow hald_t system_dbusd_t:dbus { acquire_svc };
>  
>  allow hald_t { self proc_t }:file { getattr read };
>  
> @@ -31,6 +31,7 @@
>  allow hald_t self:capability { net_admin sys_admin };
>  can_network(hald_t)
>  can_ypbind(hald_t)
> +dbusd_client(system, hald_t)
>  
>  allow hald_t device_t:lnk_file read;
>  allow hald_t { fixed_disk_device_t removable_device_t }:blk_file { getattr read ioctl };
> @@ -47,3 +48,5 @@
>  
>  allow hald_t usbdevfs_t:dir search;
>  allow hald_t usbdevfs_t:file { getattr read };
> +allow hald_t usbfs_t:dir search;
> +allow hald_t usbfs_t:file { getattr read };
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/hotplug.te policy-1.17.10/domains/program/unused/hotplug.te
> --- nsapolicy/domains/program/unused/hotplug.te	2004-09-01 14:00:02.000000000 -0400
> +++ policy-1.17.10/domains/program/unused/hotplug.te	2004-09-07 15:55:15.128936121 -0400
> @@ -11,7 +11,7 @@
>  # hotplug_exec_t is the type of the hotplug executable.
>  #
>  ifdef(`unlimitedUtils', `
> -daemon_domain(hotplug, `, admin, etc_writer, fs_domain, privmem, auth_write, privowner, privmodule, domain, privlog, sysctl_kernel_writer, dbus_client_domain, unrestricted')
> +daemon_domain(hotplug, `, admin, etc_writer, fs_domain, privmem, auth_write, privowner, privmodule, domain, privlog, sysctl_kernel_writer, unrestricted')
>  ', `
>  daemon_domain(hotplug, `, privmodule, dbus_client_domain')
>  ')
> @@ -143,6 +143,7 @@
>  
>  can_network(hotplug_t)
>  can_ypbind(hotplug_t)
> +dbusd_client(system, hotplug_t)
>  
>  # Allow hotplug (including /sbin/ifup-local) to start/stop services and # run sendmail -q
>  domain_auto_trans(hotplug_t, initrc_exec_t, initrc_t)
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/kudzu.te policy-1.17.10/domains/program/unused/kudzu.te
> --- nsapolicy/domains/program/unused/kudzu.te	2004-08-27 14:44:11.000000000 -0400
> +++ policy-1.17.10/domains/program/unused/kudzu.te	2004-09-07 15:54:49.325454423 -0400
> @@ -29,6 +29,8 @@
>  allow kudzu_t sysctl_kernel_t:file { getattr read write };
>  allow kudzu_t usbdevfs_t:dir search;
>  allow kudzu_t usbdevfs_t:file { getattr read };
> +allow kudzu_t usbfs_t:dir search;
> +allow kudzu_t usbfs_t:file { getattr read };
>  allow kudzu_t var_t:dir search;
>  allow kudzu_t kernel_t:system { syslog_console };
>  allow kudzu_t self:udp_socket { create ioctl };
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/udev.te policy-1.17.10/domains/program/unused/udev.te
> --- nsapolicy/domains/program/unused/udev.te	2004-09-01 14:00:02.000000000 -0400
> +++ policy-1.17.10/domains/program/unused/udev.te	2004-09-07 16:00:22.809653212 -0400
> @@ -9,7 +9,7 @@
>  #
>  # udev_exec_t is the type of the udev executable.
>  #
> -daemon_domain(udev, `, privmodule, privmem, fs_domain, privfd, dbus_client_domain')
> +daemon_domain(udev, `, privmodule, privmem, fs_domain, privfd')
>  
>  general_domain_access(udev_t)
>  
> @@ -28,10 +28,10 @@
>  allow udev_t self:unix_stream_socket {connectto create_stream_socket_perms};
>  allow udev_t self:unix_dgram_socket create_socket_perms;
>  allow udev_t self:fifo_file rw_file_perms;
> -allow udev_t device_t:blk_file create_file_perms;
> -allow udev_t device_t:chr_file create_file_perms;
> -allow udev_t device_t:sock_file create_file_perms;
> -allow udev_t device_t:lnk_file create_lnk_perms;
> +allow udev_t { tmpfs_t device_t }:blk_file create_file_perms;
> +allow udev_t { tmpfs_t device_t }:chr_file create_file_perms;
> +allow udev_t { tmpfs_t device_t }:sock_file create_file_perms;
> +allow udev_t { tmpfs_t device_t }:lnk_file create_lnk_perms;
>  allow udev_t etc_t:file { getattr read };
>  allow udev_t { bin_t sbin_t }:dir r_dir_perms;
>  allow udev_t { sbin_t bin_t }:lnk_file read;
> @@ -40,7 +40,7 @@
>  can_exec(udev_t, udev_exec_t)
>  r_dir_file(udev_t, sysfs_t)
>  allow udev_t sysadm_tty_device_t:chr_file { read write };
> -allow udev_t { device_t device_type }:{chr_file blk_file} { relabelfrom relabelto create_file_perms };
> +allow udev_t { tmpfs_t device_t device_type }:{chr_file blk_file} { relabelfrom relabelto create_file_perms };
>  	
>  # to read the file_contexts file
>  r_dir_file(udev_t, { selinux_config_t file_context_t default_context_t } )
> @@ -96,3 +96,10 @@
>  ifdef(`dhcpc.te', `
>  domain_auto_trans(udev_t, dhcpc_exec_t, dhcpc_t)
>  ')
> +
> +allow udev_t tmpfs_t:dir { search };
> +rw_dir_create_file(udev_t, { device_t tmpfs_t })
> +allow udev_t udev_helper_exec_t:dir r_dir_perms;
> +
> +dbusd_client(system, udev_t)
> +
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/updfstab.te policy-1.17.10/domains/program/unused/updfstab.te
> --- nsapolicy/domains/program/unused/updfstab.te	2004-09-02 08:03:26.000000000 -0400
> +++ policy-1.17.10/domains/program/unused/updfstab.te	2004-09-07 15:55:15.115937391 -0400
> @@ -3,7 +3,7 @@
>  # Author:  Russell Coker <russell@coker.com.au>
>  #
>  
> -daemon_base_domain(updfstab, `, fs_domain, etc_writer, dbus_client_domain')
> +daemon_base_domain(updfstab, `, fs_domain, etc_writer')
>  
>  rw_dir_create_file(updfstab_t, etc_t)
>  create_dir_file(updfstab_t, mnt_t)
> @@ -28,6 +28,8 @@
>  
>  read_locale(updfstab_t)
>  
> +dbusd_client(system, updfstab_t)
> +
>  # not sure what the sysctl_kernel_t file is, or why it wants to write it, so
>  # I will not allow it
>  dontaudit updfstab_t { sysctl_t sysctl_kernel_t }:dir search;
> diff --exclude-from=exclude -N -u -r nsapolicy/file_contexts/program/named.fc policy-1.17.10/file_contexts/program/named.fc
> --- nsapolicy/file_contexts/program/named.fc	2004-08-31 10:55:37.000000000 -0400
> +++ policy-1.17.10/file_contexts/program/named.fc	2004-09-07 15:54:49.325454423 -0400
> @@ -14,7 +14,7 @@
>  ') dnl distro_debian
>  
>  /etc/rndc.*		--	system_u:object_r:named_conf_t
> -/usr/sbin/named.*      	--	system_u:object_r:named_exec_t
> +/usr/sbin/named      	--	system_u:object_r:named_exec_t
>  /usr/sbin/r?ndc		--	system_u:object_r:ndc_exec_t
>  /var/run/ndc		-s	system_u:object_r:named_var_run_t
>  /var/run/bind(/.*)?		system_u:object_r:named_var_run_t
> diff --exclude-from=exclude -N -u -r nsapolicy/macros/base_user_macros.te policy-1.17.10/macros/base_user_macros.te
> --- nsapolicy/macros/base_user_macros.te	2004-09-04 07:28:25.000000000 -0400
> +++ policy-1.17.10/macros/base_user_macros.te	2004-09-07 15:55:15.195929577 -0400
> @@ -185,6 +185,10 @@
>  can_network($1_t)
>  can_ypbind($1_t)
>  
> +# Grant permissions to access the system DBus
> +dbusd_client(system, $1_t)
> +dbusd_domain($1)
> +
>  # allow port_t name binding for UDP because it is not very usable otherwise
>  allow $1_t port_t:udp_socket name_bind;
>  
> diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/dbusd_macros.te policy-1.17.10/macros/program/dbusd_macros.te
> --- nsapolicy/macros/program/dbusd_macros.te	1969-12-31 19:00:00.000000000 -0500
> +++ policy-1.17.10/macros/program/dbusd_macros.te	2004-09-07 15:55:15.038944913 -0400
> @@ -0,0 +1,62 @@
> +#
> +# Macros for Dbus
> +#
> +# Author: Colin Walters <walters@redhat.com>
> +
> +# dbusd_domain(domain_prefix)
> +#
> +# Define a derived domain for the DBus daemon.
> +
> +define(`dbusd_domain', `
> +ifelse(`system', `$1',`
> +daemon_domain(system_dbusd, `, userspace_objmgr')
> +# For backwards compatibility
> +typealias system_dbusd_t alias dbusd_t;
> +typealias system_dbusd_exec_t alias dbusd_exec_t;
> +typealias system_dbusd_var_run_t alias dbusd_var_run_t;
> +type etc_dbusd_t, file_type, sysadmfile;
> +',`
> +ifdef(`single_userdomain', `
> +typealias $1_t alias $1_dbusd_t;
> +', `
> +type $1_dbusd_t, domain, privlog, userspace_objmgr;
> +role $1_r types $1_dbusd_t;
> +domain_auto_trans($1_t, dbusd_exec_t, $1_dbusd_t)
> +
> +')dnl end ifdef single_userdomain
> +')dnl end ifelse system
> +
> +base_file_read_access($1_dbusd_t)
> +uses_shlib($1_dbusd_t)
> +allow $1_dbusd_t etc_t:file { getattr read };
> +r_dir_file($1_dbusd_t, etc_dbusd_t)
> +
> +allow $1_dbusd_t self:unix_stream_socket create_stream_socket_perms;
> +allow $1_dbusd_t self:unix_dgram_socket create_socket_perms;
> +
> +allow $1_dbusd_t urandom_device_t:chr_file { getattr read };
> +allow $1_dbusd_t self:file { getattr read };
> +allow $1_dbusd_t proc_t:file { read };
> +
> +')dnl end dbusd_domain definition
> +
> +# dbusd_client(dbus_type, domain)
> +# Example: dbusd_client_domain(system, user_t)
> +#
> +# Grant permissions for connecting to the specified DBus type
> +# from domain.
> +define(`dbusd_client',`')
> +ifdef(`dbusd.te',`
> +undefine(`dbusd_client')
> +define(`dbusd_client',`
> +# For connecting to the bus
> +allow $2 $1_dbusd_t:unix_stream_socket { connectto };
> +ifelse(`system', `$1', `
> +allow { $2 } { var_run_t system_dbusd_var_run_t }:dir search;
> +allow { $2 } system_dbusd_var_run_t:sock_file { write };
> +',`
> +') dnl endif system
> +# SE-DBus specific permissions
> +allow $2 { $1_dbusd_t self }:dbus { send_msg };
> +') dnl endif dbusd.te
> +')
> diff --exclude-from=exclude -N -u -r nsapolicy/tunables/distro.tun policy-1.17.10/tunables/distro.tun
> --- nsapolicy/tunables/distro.tun	2004-08-27 14:44:11.000000000 -0400
> +++ policy-1.17.10/tunables/distro.tun	2004-09-07 15:54:49.326454326 -0400
> @@ -5,7 +5,7 @@
>  # appropriate ifdefs.
>  
> 
> -dnl define(`distro_redhat')
> +define(`distro_redhat')
>  
>  dnl define(`distro_suse')
>  
> diff --exclude-from=exclude -N -u -r nsapolicy/tunables/tunable.tun policy-1.17.10/tunables/tunable.tun
> --- nsapolicy/tunables/tunable.tun	2004-08-27 14:44:11.000000000 -0400
> +++ policy-1.17.10/tunables/tunable.tun	2004-09-07 15:54:49.327454228 -0400
> @@ -5,50 +5,47 @@
>  dnl define(`user_net_control')
>  
>  # Allow users to execute the mount command
> -dnl define(`user_can_mount')
> +define(`user_can_mount')
>  
>  # Allow rpm to run unconfined.
> -dnl define(`unlimitedRPM')
> +define(`unlimitedRPM')
>  
>  # Allow privileged utilities like hotplug and insmod to run unconfined.
> -dnl define(`unlimitedUtils')
> +define(`unlimitedUtils')
>  
>  # Support NFS home directories
> -dnl define(`nfs_home_dirs')
> +define(`nfs_home_dirs')
>  
>  # Allow users to run games
> -dnl define(`use_games')
> +define(`use_games')
>  
>  # Allow ypbind to run with NIS
> -dnl define(`allow_ypbind')
> +define(`allow_ypbind')
>  
>  # Allow rc scripts to run unconfined, including any daemon
>  # started by an rc script that does not have a domain transition
>  # explicitly defined.
> -dnl define(`unlimitedRC')
> +define(`unlimitedRC')
>  
>  # Allow sysadm_t to directly start daemons
>  define(`direct_sysadm_daemon')
>  
>  # Do not audit things that we know to be broken but which
>  # are not security risks
> -dnl define(`hide_broken_symptoms')
> +define(`hide_broken_symptoms')
>  
>  # Allow sysadm_t to do almost everything
>  dnl define(`unrestricted_admin')
>  
>  # Allow the read/write/create on any NFS file system
> -dnl define(`nfs_export_all_rw')
> -
> -# Allow users to unrestricted access
> -dnl define(`unlimitedUsers')
> +define(`nfs_export_all_rw')
>  
>  # Allow the reading on any NFS file system
>  dnl define(`nfs_export_all_ro')
>  
>  # Allow user_r to reach sysadm_r via su, sudo, or userhelper.
>  # Otherwise, only staff_r can do so.
> -dnl define(`user_canbe_sysadm')
> +define(`user_canbe_sysadm')
>  
>  # Allow xinetd to run unconfined, including any services it starts
>  # that do not have a domain transition explicitly defined.
> diff --exclude-from=exclude -N -u -r nsapolicy/types/file.te policy-1.17.10/types/file.te
> --- nsapolicy/types/file.te	2004-08-30 09:49:16.000000000 -0400
> +++ policy-1.17.10/types/file.te	2004-09-07 15:54:49.327454228 -0400
> @@ -258,6 +258,7 @@
>  # the default file system type.
>  #
>  allow { file_type device_type } fs_t:filesystem associate;
> +allow { file_type device_type } tmpfs_t:filesystem associate;
>  
>  # Allow the pty to be associated with the file system.
>  allow devpts_t devpts_t:filesystem associate;
-- 
James Carter <jwcart2@epoch.ncsc.mil>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Patch to make udev/tmpfs work and changes from colin  walters for dbus.
  2004-09-09 12:53 ` James Carter
@ 2004-09-09 18:21   ` Colin Walters
  2004-09-09 20:26     ` James Carter
  0 siblings, 1 reply; 10+ messages in thread
From: Colin Walters @ 2004-09-09 18:21 UTC (permalink / raw)
  To: jwcart2; +Cc: Daniel J Walsh, Stephen Smalley, SELinux


[-- Attachment #1.1: Type: text/plain, Size: 613 bytes --]

On Thu, 2004-09-09 at 08:53 -0400, James Carter wrote:
> When I build the policy with this patch there is a conflict with two
> type transitions.
> 
> Because of the alias rule:
> typealias system_dbusd_exec_t alias dbusd_exec_t;
> 
> The following type transitions conflict:
> type_transition sysadm_t dbusd_exec_t:process sysadm_dbusd_t;
> type_transition sysadm_t system_dbusd_exec_t:process system_dbusd_t;
> 
> The second transition is the one used when I build the policy.  I am not
> sure if that is the desired transition.

Hm.  Yes, we actually want the former.  Can you try this patch?


[-- Attachment #1.2: se-dbus-nosysadm.patch --]
[-- Type: text/x-patch, Size: 460 bytes --]

--- macros/program/dbusd_macros.te~	2004-09-09 14:08:20.192951192 -0400
+++ macros/program/dbusd_macros.te	2004-09-09 14:19:06.701666928 -0400
@@ -9,7 +9,7 @@
 
 define(`dbusd_domain', `
 ifelse(`system', `$1',`
-daemon_domain(system_dbusd, `, userspace_objmgr')
+daemon_domain(system_dbusd, `, userspace_objmgr', `nosysadm')
 # For backwards compatibility
 typealias system_dbusd_t alias dbusd_t;
 typealias system_dbusd_exec_t alias dbusd_exec_t;

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

^ permalink raw reply	[flat|nested] 10+ messages in thread

* Re: Patch to make udev/tmpfs work and changes from colin  walters for dbus.
  2004-09-09 18:21   ` Colin Walters
@ 2004-09-09 20:26     ` James Carter
  0 siblings, 0 replies; 10+ messages in thread
From: James Carter @ 2004-09-09 20:26 UTC (permalink / raw)
  To: Colin Walters; +Cc: Daniel J Walsh, Stephen Smalley, SELinux

That works.
Merged the original patch along with this fix.

On Thu, 2004-09-09 at 14:21, Colin Walters wrote:
> On Thu, 2004-09-09 at 08:53 -0400, James Carter wrote:
> > When I build the policy with this patch there is a conflict with two
> > type transitions.
> > 
> > Because of the alias rule:
> > typealias system_dbusd_exec_t alias dbusd_exec_t;
> > 
> > The following type transitions conflict:
> > type_transition sysadm_t dbusd_exec_t:process sysadm_dbusd_t;
> > type_transition sysadm_t system_dbusd_exec_t:process system_dbusd_t;
> > 
> > The second transition is the one used when I build the policy.  I am not
> > sure if that is the desired transition.
> 
> Hm.  Yes, we actually want the former.  Can you try this patch?
-- 
James Carter <jwcart2@epoch.ncsc.mil>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2004-09-09 20:27 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-09-07 20:45 Patch to make udev/tmpfs work and changes from colin walters for dbus Daniel J Walsh
2004-09-08  0:00 ` Luke Kenneth Casson Leighton
2004-09-08 12:17 ` Stephen Smalley
2004-09-08 14:57   ` Daniel J Walsh
2004-09-08 15:12     ` Stephen Smalley
2004-09-08 15:35       ` Daniel J Walsh
2004-09-08 22:04   ` Luke Kenneth Casson Leighton
2004-09-09 12:53 ` James Carter
2004-09-09 18:21   ` Colin Walters
2004-09-09 20:26     ` James Carter

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.