[refpolicy] RFC init_daemon_run_file

[cpebenito@tresys.com (Christopher J. PeBenito)]

On 3/4/2014 1:15 PM, Sven Vermeulen wrote:
> On Tue, Mar 04, 2014 at 06:25:07PM +0100, Sven Vermeulen wrote:
>> A couple of init scripts create PID files for their respective daemons
>> (domains) in the /run location. Right now, the SELinux policy supports
>> transitions for directories that are created in /run through the
>> init_daemon_run_dir() method.
> [...]
> 
> bigon mentioned on #selinux that this was suggested end of 2012 [1]. There,
> the suggestion was to generalize the existing method (init_daemon_run_dir)
> to one that takes the class with it. However, there was no concensus on the
> name (and "init_daemon_run" wouldn't cut it).
> 
> May I suggest the following?
> 
> interface(`init_script_generic_run_filetrans_spec',`
>   gen_require(`
>   	attribute daemonpidfile;
> 	type initrc_t;
>   ')
> 
>   typeattribute $1 daemonpidfile;
> 
>   files_pid_filetrans(initrc_t, $1, $2, $3)
> ')
> 
> The name would be chosen due to the following:
> 
> - init_script_ (instead of init_) to identify that this is about initrc_t.
> - generic_run_ to inform that we start from the generic run type (var_run_t)
> - filetrans_ (because it is a file transition)
> - spec (because it transitions to the specified type rather than a
>   module-provided one).

I think I'd go with init_daemon_pid_file().  I'm thinking that we should skip the "script" portion since it's not so relevant; with systemd coming along, the init/initrc line is blurring or disappearing.  I think the interface should also be calling files_pid_file().

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com