[refpolicy] are we going to have unit file types?

[pebenito@ieee.org (Chris PeBenito)]

On 08/02/16 23:08, Jason Zaman wrote:
> On Tue, Aug 02, 2016 at 07:26:23PM -0400, Chris PeBenito wrote:
>> On 08/02/16 08:16, Russell Coker wrote:
>>> On Mon, 1 Aug 2016 12:35:56 AM Jason Zaman wrote:
>>>> On Sun, Jul 31, 2016 at 10:40:41PM +1000, Russell Coker wrote:
>>>>> Below is a patch that's been in my Debian tree for some time, I didn't
>>>>> write it I took it from rawhide some years ago.
>>>>>
>>>>>
>>>>>
>>>>> Is this the way we are going to do things?  If so I can tidy it up and
>>>>> submit it.  If not I'll delete it and make the Debian policy work without
>>>>> it.
>>>>>
>>>>>
>>>>>
>>>>> Note that I am not suggesting this patch for inclusion at the
>>>>> moment.  I'm just offering it for discussion.
>>>>
>>>> We have unit files in refpol yeah, they are different from the stuff in
>>>> redhat tho i think.
>>>>
>>>> A whole bunch like this for example:
>>>> mandb.te:type mandb_unit_t;
>>>> mandb.te:init_unit_file(mandb_unit_t)
>>>> mandb.fc:/usr/lib/systemd/system/[^/]*man-db.*  --      gen_context(system_
>>>> u:object_r:mandb_unit_t,s0)
>>>
>>> Thanks for the pointer.
>>>
>>> Is the plan that every daemon domain will get a _unit_t type?  I've revised
>>
>> There weren't any specific plans to ensure all daemons have a unit, but
>> I'm open to that.
>
> There somewhat were. At least cases where there was a foo_initrc_exec_t
> should probably also have a _unit_t. I added init_startstop_service() to
> a ton of things a while back. The intention was that it takes pretty
> much everything needed for all the different types of init daemons
> (sysvinit, openrc, upstart, systemd) and gives the perms for it in
> tunables/booleans. The unit param is optional still tho cuz not all
> domains have it yet I think.
>
> I also just realized that all the fcontexts in the policy are only for
> /usr/lib/systemd/system/ but units can also be in /etc/ or /run. Do we
> need to add a subs_dist for this?

I don't think so.  The /etc ones are considered local configuration, so 
that probably needs something like local_unit_t. The /run ones don't 
either as those are runtime units. There is a github issue I opened for 
it forever ago:

[1] https://github.com/TresysTechnology/refpolicy/issues/12

-- 
Chris PeBenito