[refpolicy] [PATCH v3 0/2] Introduce substitution for /usr/local/lib* and /etc/init.d

All of lore.kernel.org
 help / color / mirror / Atom feed

* [refpolicy] [PATCH v3 0/2] Introduce substitution for /usr/local/lib* and /etc/init.d
@ 2012-08-10 14:39 Sven Vermeulen
  2012-08-10 14:39 ` [refpolicy] [PATCH v3 1/2] Use substititions for /usr/local/lib " Sven Vermeulen
  2012-08-10 14:40 ` [refpolicy] [PATCH v3 2/2] Update with new substitutions Sven Vermeulen
  0 siblings, 2 replies; 4+ messages in thread
From: Sven Vermeulen @ 2012-08-10 14:39 UTC (permalink / raw)
  To: refpolicy

This patchset contains the suggestion to also have a substitition for
/usr/local/lib* towards /usr/lib since manually installed applications use
/usr/local/lib* for their libraries (instead of /usr/lib) but *should* have the
same structure otherwise.

This is not only to clean up the defined file contexts a bit (there are not that
many references to /usr/local) but mainly to support such installed applications
almost out-of-the-box with our policies.

A second substitution is for init scripts defined in /etc/init\.d, which we now
map to /etc/rc\.d/init\.d (already used in the majority of cases in the policy).
For those distributions that do use /etc/init\.d though they need to take care
to always use /etc/rc\.d/init\.d since the translation (substitution) takes
precedence before the file contexts are looked at.

Changelog since v2
------------------

- Readded definition for /etc/rc.d/init.d/zookeeper, thanks to Guido Trentalancia
  for noticing it went missing

^ permalink raw reply	[flat|nested] 4+ messages in thread

* [refpolicy] [PATCH v3 1/2] Use substititions for /usr/local/lib and /etc/init.d
  2012-08-10 14:39 [refpolicy] [PATCH v3 0/2] Introduce substitution for /usr/local/lib* and /etc/init.d Sven Vermeulen
@ 2012-08-10 14:39 ` Sven Vermeulen
  2012-08-10 14:40 ` [refpolicy] [PATCH v3 2/2] Update with new substitutions Sven Vermeulen
  1 sibling, 0 replies; 4+ messages in thread
From: Sven Vermeulen @ 2012-08-10 14:39 UTC (permalink / raw)
  To: refpolicy


Introduce the substitutions for the /usr/local/lib* locations (towards /usr/lib)
and /etc/init.d (towards /etc/rc.d/init.d).

Update the file contexts of the translated locations.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 config/file_contexts.subs_dist        |    4 ++++
 policy/modules/kernel/corecommands.fc |    3 ---
 policy/modules/kernel/files.fc        |    2 +-
 policy/modules/services/xserver.fc    |    4 ++--
 policy/modules/system/init.fc         |    2 --
 policy/modules/system/ipsec.fc        |    5 -----
 policy/modules/system/libraries.fc    |    1 -
 7 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/config/file_contexts.subs_dist b/config/file_contexts.subs_dist
index 32b87a4..5c93bb4 100644
--- a/config/file_contexts.subs_dist
+++ b/config/file_contexts.subs_dist
@@ -1,7 +1,11 @@
+/etc/init.d /etc/rc.d/init.d
 /lib32 /lib
 /lib64 /lib
 /run /var/run
 /run/lock /var/lock
 /usr/lib32 /usr/lib
 /usr/lib64 /usr/lib
+/usr/local/lib32 /usr/lib
+/usr/local/lib64 /usr/lib
+/usr/local/lib/ /usr/lib/
 /var/run/lock /var/lock
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index 16b3f1b..9020aa1 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -66,8 +66,6 @@ ifdef(`distro_redhat',`
 /etc/hotplug/hotplug\.functions --	gen_context(system_u:object_r:bin_t,s0)
 /etc/hotplug\.d/default/default.*	gen_context(system_u:object_r:bin_t,s0)
 
-/etc/init\.d/functions		--	gen_context(system_u:object_r:bin_t,s0)
-
 /etc/kde/env(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 /etc/kde/shutdown(/.*)?			gen_context(system_u:object_r:bin_t,s0)
 
@@ -257,7 +255,6 @@ ifdef(`distro_gentoo',`
 
 /usr/libexec/openssh/sftp-server --	gen_context(system_u:object_r:bin_t,s0)
 
-/usr/local/lib(64)?/ipsec/.*	-- 	gen_context(system_u:object_r:bin_t,s0)
 /usr/local/Brother(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/local/Printer(/.*)?		gen_context(system_u:object_r:bin_t,s0)
 /usr/local/linuxprinter/filters(/.*)?	gen_context(system_u:object_r:bin_t,s0)
diff --git a/policy/modules/kernel/files.fc b/policy/modules/kernel/files.fc
index 8796ca3..1975fc4 100644
--- a/policy/modules/kernel/files.fc
+++ b/policy/modules/kernel/files.fc
@@ -84,7 +84,7 @@ ifdef(`distro_redhat',`
 
 ifdef(`distro_suse',`
 /etc/defkeymap\.map	--	gen_context(system_u:object_r:etc_runtime_t,s0)
-/etc/init\.d/\.depend.*	--	gen_context(system_u:object_r:etc_runtime_t,s0)
+/etc/rc\.d/init\.d/\.depend.* -- gen_context(system_u:object_r:etc_runtime_t,s0)
 ')
 
 #
diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc
index fc86b7c..be8f670 100644
--- a/policy/modules/services/xserver.fc
+++ b/policy/modules/services/xserver.fc
@@ -22,13 +22,13 @@ HOME_DIR/\.Xauthority.*	--	gen_context(system_u:object_r:xauth_home_t,s0)
 /etc/gdm/PreSession/.*	--	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/gdm/Xsession	--	gen_context(system_u:object_r:xsession_exec_t,s0)
 
-/etc/init\.d/xfree86-common --	gen_context(system_u:object_r:xserver_exec_t,s0)
-
 /etc/kde[34]?/kdm/Xstartup --	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/kde[34]?/kdm/Xreset --	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/kde[34]?/kdm/Xsession --	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/kde[34]?/kdm/backgroundrc	gen_context(system_u:object_r:xdm_var_run_t,s0)
 
+/etc/rc\.d/init\.d/xfree86-common -- gen_context(system_u:object_r:xserver_exec_t,s0)
+
 /etc/X11/[wx]dm/Xreset.* --	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/X11/[wxg]dm/Xsession --	gen_context(system_u:object_r:xsession_exec_t,s0)
 /etc/X11/wdm(/.*)?		gen_context(system_u:object_r:xdm_rw_etc_t,s0)
diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index d2e40b8..03e27db 100644
--- a/policy/modules/system/init.fc
+++ b/policy/modules/system/init.fc
@@ -1,8 +1,6 @@
 #
 # /etc
 #
-/etc/init\.d/.*		--	gen_context(system_u:object_r:initrc_exec_t,s0)
-
 /etc/rc\.d/rc		--	gen_context(system_u:object_r:initrc_exec_t,s0)
 /etc/rc\.d/rc\.[^/]+	--	gen_context(system_u:object_r:initrc_exec_t,s0)
 
diff --git a/policy/modules/system/ipsec.fc b/policy/modules/system/ipsec.fc
index ec85acb..662e79b 100644
--- a/policy/modules/system/ipsec.fc
+++ b/policy/modules/system/ipsec.fc
@@ -27,11 +27,6 @@
 /usr/libexec/ipsec/spi		--	gen_context(system_u:object_r:ipsec_exec_t,s0)
 /usr/libexec/nm-openswan-service -- 	gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
 
-/usr/local/lib(64)?/ipsec/eroute --	gen_context(system_u:object_r:ipsec_exec_t,s0)
-/usr/local/lib(64)?/ipsec/klipsdebug -- gen_context(system_u:object_r:ipsec_exec_t,s0)
-/usr/local/lib(64)?/ipsec/pluto --	gen_context(system_u:object_r:ipsec_exec_t,s0)
-/usr/local/lib(64)?/ipsec/spi	--	gen_context(system_u:object_r:ipsec_exec_t,s0)
-
 /usr/sbin/ipsec			-- 	gen_context(system_u:object_r:ipsec_mgmt_exec_t,s0)
 /usr/sbin/racoon		--	gen_context(system_u:object_r:racoon_exec_t,s0)
 /usr/sbin/setkey		--	gen_context(system_u:object_r:setkey_exec_t,s0)
diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
index ef8bbaf..f302477 100644
--- a/policy/modules/system/libraries.fc
+++ b/policy/modules/system/libraries.fc
@@ -242,7 +242,6 @@ HOME_DIR/.*/plugins/nppdf\.so.* 	--	gen_context(system_u:object_r:textrel_shlib_
 /usr/lib.*/libmpg123\.so(\.[^/]*)*	--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/local(/.*)?/libmpg123\.so(\.[^/]*)* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/lib/codecs/drv[1-9c]\.so(\.[^/]*)* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
-/usr/local/lib/codecs/drv[1-9c]\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
 
 HOME_DIR/.*/plugins/nppdf\.so		--	gen_context(system_u:object_r:textrel_shlib_t,s0)
 HOME_DIR/.mozilla/plugins/nprhapengine\.so.* --	gen_context(system_u:object_r:textrel_shlib_t,s0)
-- 
1.7.8.6

^ permalink raw reply related	[flat|nested] 4+ messages in thread

* [refpolicy] [PATCH v3 2/2] Update with new substitutions
  2012-08-10 14:39 [refpolicy] [PATCH v3 0/2] Introduce substitution for /usr/local/lib* and /etc/init.d Sven Vermeulen
  2012-08-10 14:39 ` [refpolicy] [PATCH v3 1/2] Use substititions for /usr/local/lib " Sven Vermeulen
@ 2012-08-10 14:40 ` Sven Vermeulen
  2012-08-15 15:47   ` Christopher J. PeBenito
  1 sibling, 1 reply; 4+ messages in thread
From: Sven Vermeulen @ 2012-08-10 14:40 UTC (permalink / raw)
  To: refpolicy


The recently introduced substitutions for /usr/local/lib* and /etc/init.d also
reflect in the file contexts of a few contrib modules.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 hadoop.fc    |    8 +-------
 inetd.fc     |    2 +-
 tmpreaper.fc |    4 ++--
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/hadoop.fc b/hadoop.fc
index 633c470..2d0f90a 100644
--- a/hadoop.fc
+++ b/hadoop.fc
@@ -1,18 +1,12 @@
 /etc/hadoop.*							gen_context(system_u:object_r:hadoop_etc_t,s0)
 
-/etc/init\.d/hadoop-(.*-)?datanode			--	gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0)
-/etc/init\.d/hadoop-(.*-)?jobtracker			--	gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0)
-/etc/init\.d/hadoop-(.*-)?namenode			--	gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0)
-/etc/init\.d/hadoop-(.*-)?secondarynamenode		--	gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0)
-/etc/init\.d/hadoop-(.*-)?tasktracker			--	gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0)
-/etc/init\.d/zookeeper					--	gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0)
-
 /etc/rc\.d/init\.d/hadoop-(.*-)?datanode		--	gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/hadoop-(.*-)?jobtracker		--	gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/hadoop-(.*-)?namenode		--	gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/hadoop-(.*-)?secondarynamenode	--	gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/hadoop-(.*-)?tasktracker		--	gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0)
 /etc/rc\.d/init\.d/hadoop-zookeeper			--	gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0)
+/etc/rc\.d/init\.d/zookeeper				--	gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0)
 
 /etc/zookeeper(/.*)?						gen_context(system_u:object_r:zookeeper_etc_t,s0)
 /etc/zookeeper\.dist(/.*)?					gen_context(system_u:object_r:zookeeper_etc_t,s0)
diff --git a/inetd.fc b/inetd.fc
index 39d5baa..6107467 100644
--- a/inetd.fc
+++ b/inetd.fc
@@ -1,7 +1,7 @@
+/usr/lib/pysieved/pysieved.*\.py -- gen_context(system_u:object_r:inetd_child_exec_t,s0)
 
 /usr/sbin/identd	--	gen_context(system_u:object_r:inetd_child_exec_t,s0)
 /usr/sbin/in\..*d	--	gen_context(system_u:object_r:inetd_child_exec_t,s0)
-/usr/local/lib/pysieved/pysieved.*\.py -- gen_context(system_u:object_r:inetd_child_exec_t,s0)
 
 /usr/sbin/inetd		--	gen_context(system_u:object_r:inetd_exec_t,s0)
 /usr/sbin/rlinetd	--	gen_context(system_u:object_r:inetd_exec_t,s0)
diff --git a/tmpreaper.fc b/tmpreaper.fc
index fcc10e8..42ee122 100644
--- a/tmpreaper.fc
+++ b/tmpreaper.fc
@@ -1,6 +1,6 @@
 ifdef(`distro_debian',`
-/etc/init\.d/mountall-bootclean.sh --	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
-/etc/init\.d/mountnfs-bootclean.sh --	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
+/etc/rc\.d/init\.d/mountall-bootclean.sh --	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
+/etc/rc\.d/init\.d/mountnfs-bootclean.sh --	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
 ')
 
 /usr/sbin/tmpreaper		--	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
-- 
1.7.8.6

^ permalink raw reply related	[flat|nested] 4+ messages in thread

* [refpolicy] [PATCH v3 2/2] Update with new substitutions
  2012-08-10 14:40 ` [refpolicy] [PATCH v3 2/2] Update with new substitutions Sven Vermeulen
@ 2012-08-15 15:47   ` Christopher J. PeBenito
  0 siblings, 0 replies; 4+ messages in thread
From: Christopher J. PeBenito @ 2012-08-15 15:47 UTC (permalink / raw)
  To: refpolicy

On 08/10/12 10:40, Sven Vermeulen wrote:
> The recently introduced substitutions for /usr/local/lib* and /etc/init.d also
> reflect in the file contexts of a few contrib modules.

Merged.
 
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> ---
>  hadoop.fc    |    8 +-------
>  inetd.fc     |    2 +-
>  tmpreaper.fc |    4 ++--
>  3 files changed, 4 insertions(+), 10 deletions(-)
> 
> diff --git a/hadoop.fc b/hadoop.fc
> index 633c470..2d0f90a 100644
> --- a/hadoop.fc
> +++ b/hadoop.fc
> @@ -1,18 +1,12 @@
>  /etc/hadoop.*							gen_context(system_u:object_r:hadoop_etc_t,s0)
>  
> -/etc/init\.d/hadoop-(.*-)?datanode			--	gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0)
> -/etc/init\.d/hadoop-(.*-)?jobtracker			--	gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0)
> -/etc/init\.d/hadoop-(.*-)?namenode			--	gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0)
> -/etc/init\.d/hadoop-(.*-)?secondarynamenode		--	gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0)
> -/etc/init\.d/hadoop-(.*-)?tasktracker			--	gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0)
> -/etc/init\.d/zookeeper					--	gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0)
> -
>  /etc/rc\.d/init\.d/hadoop-(.*-)?datanode		--	gen_context(system_u:object_r:hadoop_datanode_initrc_exec_t,s0)
>  /etc/rc\.d/init\.d/hadoop-(.*-)?jobtracker		--	gen_context(system_u:object_r:hadoop_jobtracker_initrc_exec_t,s0)
>  /etc/rc\.d/init\.d/hadoop-(.*-)?namenode		--	gen_context(system_u:object_r:hadoop_namenode_initrc_exec_t,s0)
>  /etc/rc\.d/init\.d/hadoop-(.*-)?secondarynamenode	--	gen_context(system_u:object_r:hadoop_secondarynamenode_initrc_exec_t,s0)
>  /etc/rc\.d/init\.d/hadoop-(.*-)?tasktracker		--	gen_context(system_u:object_r:hadoop_tasktracker_initrc_exec_t,s0)
>  /etc/rc\.d/init\.d/hadoop-zookeeper			--	gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0)
> +/etc/rc\.d/init\.d/zookeeper				--	gen_context(system_u:object_r:zookeeper_server_initrc_exec_t,s0)
>  
>  /etc/zookeeper(/.*)?						gen_context(system_u:object_r:zookeeper_etc_t,s0)
>  /etc/zookeeper\.dist(/.*)?					gen_context(system_u:object_r:zookeeper_etc_t,s0)
> diff --git a/inetd.fc b/inetd.fc
> index 39d5baa..6107467 100644
> --- a/inetd.fc
> +++ b/inetd.fc
> @@ -1,7 +1,7 @@
> +/usr/lib/pysieved/pysieved.*\.py -- gen_context(system_u:object_r:inetd_child_exec_t,s0)
>  
>  /usr/sbin/identd	--	gen_context(system_u:object_r:inetd_child_exec_t,s0)
>  /usr/sbin/in\..*d	--	gen_context(system_u:object_r:inetd_child_exec_t,s0)
> -/usr/local/lib/pysieved/pysieved.*\.py -- gen_context(system_u:object_r:inetd_child_exec_t,s0)
>  
>  /usr/sbin/inetd		--	gen_context(system_u:object_r:inetd_exec_t,s0)
>  /usr/sbin/rlinetd	--	gen_context(system_u:object_r:inetd_exec_t,s0)
> diff --git a/tmpreaper.fc b/tmpreaper.fc
> index fcc10e8..42ee122 100644
> --- a/tmpreaper.fc
> +++ b/tmpreaper.fc
> @@ -1,6 +1,6 @@
>  ifdef(`distro_debian',`
> -/etc/init\.d/mountall-bootclean.sh --	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
> -/etc/init\.d/mountnfs-bootclean.sh --	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
> +/etc/rc\.d/init\.d/mountall-bootclean.sh --	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
> +/etc/rc\.d/init\.d/mountnfs-bootclean.sh --	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
>  ')
>  
>  /usr/sbin/tmpreaper		--	gen_context(system_u:object_r:tmpreaper_exec_t,s0)
> 


-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2012-08-15 15:47 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-08-10 14:39 [refpolicy] [PATCH v3 0/2] Introduce substitution for /usr/local/lib* and /etc/init.d Sven Vermeulen
2012-08-10 14:39 ` [refpolicy] [PATCH v3 1/2] Use substititions for /usr/local/lib " Sven Vermeulen
2012-08-10 14:40 ` [refpolicy] [PATCH v3 2/2] Update with new substitutions Sven Vermeulen
2012-08-15 15:47   ` Christopher J. PeBenito

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.