[refpolicy] roles_unconfineduser.patch

[dwalsh@redhat.com (Daniel J Walsh)]

On 09/29/2009 10:44 AM, Christopher J. PeBenito wrote:
> On Tue, 2009-09-29 at 09:42 -0400, Daniel J Walsh wrote:
>> On 09/29/2009 09:24 AM, Christopher J. PeBenito wrote:
>>> On Fri, 2009-08-28 at 16:21 -0400, Daniel J Walsh wrote:
>>>> http://people.fedoraproject.org/~dwalsh/SELinux/F12/roles_unconfineduser.patch
>>>>
>>>> Splitting out the unconfineduser policy from the unconfined domain so
>>>> that you can leave unconfined_t but remove unconfined.pp
>>>
>>> I've been thinking about this for a while.  I don't have a problem with
>>> this in principle, but I don't see how it would work with two modules.
>>> The way I see it, the unconfineduser module would unconditionally depend
>>> on the unconfined module (which defines what it means to be unconfined),
>>> which would mean you couldn't remove the unconfined module while keeping
>>> the unconfineduser module installed.
>>>
>>
>> The trick I did to make it work is to add a dummy attribute and add another interface, 
>>
>>
>>
>> interface(`unconfined_domain',`
>> 	gen_require(`
>> 		attribute unconfined_services;
>> 	')	
>> 	unconfined_domain_noaudit($1)
>> }
>>
>> unconfined_domain_noaudit has all the rules required for unconfined_domain.
> 
> This is the problem, the attribute should be in the _noaudit interface
> instead, which breaks the desired behavior.
> 

Huh?  Removing the attribute by removing the unconfined.pp causes all domains that used to the unconfined_domain()
interface to no longer be unconfined_domains.  The types that linked against the unconfined_domain_noaudit() domain would still be unconfined.

unconfined_domain_noaudit in this case means unconfined_domains that are not services.

kernel_t, rpm_t, unconfined_t.  We want these to be unconfined_domains no matter what unconfined_t would be eliminated if you removed unconfineduser.pp

I don't see ways that you can realistically run with out kernel_t and rpm_t being unconfined.