Starting applications from initrc in a user's context?

Starting applications from initrc in a user's context?

[Mike Anderson]

Greetings Gurus of Space, Time and SELinux:

  Let me preface by saying that I'm a newbie to SELinux.  <disclaimer done>

  I'm trying to run a series of applications from the init scripts that 
I want to run in separate user contexts. Four separate init scripts all 
run from a master script that runs the user code only if tripwire says 
that the file system is kosher.  The actual launching of the four 
separate scripts is working well.  However, I'm trying to use the runcon 
command to run the applications in the separate user contexts and  I'm 
getting a transition error from the initrc domain to the user domain.  
I've added the

allow initrc_t user1_t:process { transition };

to the user domain .te file as recommended by audit2allow, but this does 
not seem to squelch this error.   As an additional gotcha, the 
applications are actually Java code and are run with the "java 
classname" invokation.

What am I missing?  Or, is there a better way of running the four 
applications in their respective user domains from the init scripts?

Regards,

Mike

-- 

---------------------------------------------------------------
Mike Anderson                    703.585.9384
CTO/Chief Scientist              mike@ThePTRGroup.com
www.ThePTRGroup.com              Embedded, Real-Time Solutions
---------------------------------------------------------------
"Software development is like making a baby. 
 You can't make a baby in one month by impregnating nine women.
 Some things just take time."
             
      -Paraphrased from The Mythical Man Month


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Starting applications from initrc in a user's context?

[Russell Coker]

On Friday 24 December 2004 02:16, Mike Anderson <mike@theptrgroup.com> wrote:
>   I'm trying to run a series of applications from the init scripts that
> I want to run in separate user contexts. Four separate init scripts all
> run from a master script that runs the user code only if tripwire says
> that the file system is kosher.  The actual launching of the four
> separate scripts is working well.  However, I'm trying to use the runcon
> command to run the applications in the separate user contexts and  I'm
> getting a transition error from the initrc domain to the user domain.
> I've added the
>
> allow initrc_t user1_t:process { transition };

Use:
domain_trans(initrc_t, shell_exec_t, user1_t)

Also you need to either allow domain user1_t to run in role system_r or allow 
a role transition from system_r to user1_r by initrc_t.

Allowing the domain user1_t in role system_r is done by:
role system_r types user1_t;

Allowing the role to be changed requires adding privrole to the attributes of 
domain initrc_t.  In that case either the identity system_u must be permitted 
to have the role user1_r or initrc_t also needs the privuser attribute so it 
can launch a process with a different identity.

> What am I missing?  Or, is there a better way of running the four
> applications in their respective user domains from the init scripts?

Maybe have cron launch them.  Cron has all privs needed to launch processes on 
behalf of users.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Starting applications from initrc in a user's context?

[Stephen Smalley]

On Tue, 2005-01-04 at 05:03, Russell Coker wrote:
> Allowing the role to be changed requires adding privrole to the attributes of 
> domain initrc_t.  In that case either the identity system_u must be permitted 
> to have the role user1_r or initrc_t also needs the privuser attribute so it 
> can launch a process with a different identity.

Role changes also require a role allow rule, e.g.
allow foo_r bar_r;

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Starting applications from initrc in a user's context?

[Russell Coker]

On Thursday 13 January 2005 03:54, Stephen Smalley <sds@epoch.ncsc.mil> wrote:
> On Tue, 2005-01-04 at 05:03, Russell Coker wrote:
> > Allowing the role to be changed requires adding privrole to the
> > attributes of domain initrc_t.  In that case either the identity system_u
> > must be permitted to have the role user1_r or initrc_t also needs the
> > privuser attribute so it can launch a process with a different identity.
>
> Role changes also require a role allow rule, e.g.
> allow foo_r bar_r;

True, but that should already be allowed.  Init scripts run as 
system_u:system_r:initrc_t, and system_r is already allowed to change to 
every role.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.