[refpolicy] [RFC 0/4 v3] add systemd support to the Mainline policy from fedora's.

[cpebenito@tresys.com (Christopher J. PeBenito)]

On 12/20/11 11:51, Justin Mattock wrote:
> with the next four emails I am sending some patches that(hopefully) add support to systemd from fedoras policy.
> Note: I am not so git savvy so creating them I had some issues with the whole contrib thing.
> Anyway the first two patches are initial systemd support. and the last two are build error fixes with make load(semodule errors)
> 
> I am unable to load the policy due to some libc error, and am looking into that at the moment, if anybody wants to try these out to see if this loads and runs then let me know. also I am unable to be connected all day(no office space) so responding might take some time. 

Dropping the SELinux list as is unnecessary to cross post.

Same question as always, has systemd stabilized?  I glanced through the first patch, and it has severe whitespace problems.  It also has problems that must be fixed, such as:

@@ -861,3 +970,24 @@ optional_policy(`
 optional_policy(`
 	zebra_read_config(initrc_t)
 ')
+
+tunable_policy(`init_systemd',`
+	allow init_t daemon:unix_stream_socket create_stream_socket_perms;
+	allow init_t daemon:unix_dgram_socket create_socket_perms;
+	allow init_t daemon:tcp_socket create_stream_socket_perms;
+	allow daemon init_t:unix_dgram_socket sendto;
+	# need write to /var/run/systemd/notify
+	init_write_pid_socket(daemon)
+	allow daemon init_t:unix_stream_socket { append write read getattr ioctl };
+')
+
+# not sure why fedora has double init_systemd here
+tunable_policy(`init_systemd',`
+	# Handle upstart/systemd direct transition to a executable
+	allow init_t systemprocess:process { dyntransition siginh };
+	allow init_t systemprocess:unix_stream_socket create_stream_socket_perms;
+	allow init_t systemprocess:unix_dgram_socket create_socket_perms;
+	allow systemprocess init_t:unix_dgram_socket sendto;
+	allow systemprocess init_t:unix_stream_socket { append write read getattr ioctl };
+')

Instead of having two blocks, they should be combined, as alluded to by the comment.  From what I can tell from the first patch, it looks like this needs more work.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com