From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E27DC433FE for ; Mon, 11 Oct 2021 16:36:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1EC7D60F35 for ; Mon, 11 Oct 2021 16:36:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232688AbhJKQi2 (ORCPT ); Mon, 11 Oct 2021 12:38:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46266 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232753AbhJKQiV (ORCPT ); Mon, 11 Oct 2021 12:38:21 -0400 X-Greylist: delayed 240 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Mon, 11 Oct 2021 09:36:21 PDT Received: from defensec.nl (markus.defensec.nl [IPv6:2001:985:d55d::123]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 65D06C061570 for ; Mon, 11 Oct 2021 09:36:21 -0700 (PDT) Received: from brutus (brutus.lan [IPv6:2001:985:d55d::438]) by defensec.nl (Postfix) with ESMTPSA id CBEF6FC081A; Mon, 11 Oct 2021 18:32:14 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=defensec.nl; s=default; t=1633969934; bh=40wqNI6wCe4R8rCsm//tRv1mvVXbya8QPXWXhJRBz20=; h=From:To:Cc:Subject:References:Date:In-Reply-To:From; b=sbEwJ80FucMEz1ezitUQ2iwLSA29lXeBh2YvFHAo6srVjxN5vexwTJmuz72h0/zg3 W9lWXvlu/qAM6FuSjenoNEhmhFHp0xjIbBydCeaQRVv6ZzroCUuHL3No7qUbh1CyB5 6nQeXt7pc2o6IbxowRCmVP1v17eKxFusfwIqWwN4= From: Dominick Grift To: Daniel Burgener Cc: Russell Coker , selinux-refpolicy@vger.kernel.org Subject: Re: [PATCH] strict policy patches References: Date: Mon, 11 Oct 2021 18:32:13 +0200 In-Reply-To: (Daniel Burgener's message of "Mon, 11 Oct 2021 12:12:42 -0400") Message-ID: <871r4rplo2.fsf@defensec.nl> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Daniel Burgener writes: >> =================================================================== >> --- refpolicy-2.20210908.orig/policy/modules/system/systemd.te >> +++ refpolicy-2.20210908/policy/modules/system/systemd.te >> @@ -65,10 +65,6 @@ type systemd_activate_t; >> type systemd_activate_exec_t; >> init_system_domain(systemd_activate_t, systemd_activate_exec_t) >> -type systemd_analyze_t; >> -type systemd_analyze_exec_t; >> -init_daemon_domain(systemd_analyze_t, systemd_analyze_exec_t) >> - >> type systemd_backlight_t; >> type systemd_backlight_exec_t; >> init_system_domain(systemd_backlight_t, systemd_backlight_exec_t) > > I proposed a similar change last year here and the consensus in the PR > discussion was that it would make more sense to add policy for the > systemd_analyze_t domain for cases that wanted a transition there, but > keeping the general approach of running in the parent domain. > > https://github.com/SELinuxProject/refpolicy/pull/321 > > Of course, no one has actually submitted systemd_analyze_t policy yet, > so maybe the demand for such a use case isn't all that high? > > -Daniel > I think I might have argued for keeping it around back then but I do not mind removing it now. It certainly is not an init_daemon_domain(). One can always add it later if needed. -- gpg --locate-keys dominick.grift@defensec.nl Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098 Dominick Grift