From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44065C433F5 for ; Mon, 11 Oct 2021 16:12:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2B7F060EDF for ; Mon, 11 Oct 2021 16:12:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231899AbhJKQOv (ORCPT ); Mon, 11 Oct 2021 12:14:51 -0400 Received: from linux.microsoft.com ([13.77.154.182]:33676 "EHLO linux.microsoft.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229544AbhJKQOv (ORCPT ); Mon, 11 Oct 2021 12:14:51 -0400 Received: from [192.168.1.10] (pool-173-66-191-184.washdc.fios.verizon.net [173.66.191.184]) by linux.microsoft.com (Postfix) with ESMTPSA id B664720B8965; Mon, 11 Oct 2021 09:12:50 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com B664720B8965 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1633968770; bh=A4ELTOvC2MXV4uGmccqe6SyZZoRpw+8wwYXwy7I7a7Y=; h=Subject:To:References:From:Date:In-Reply-To:From; b=HxDxYVT9qE/+GsiH19SxuWC4OTiUxRq7sdNfJjtHudrldVyCHCR/UXPDdqTdd5qY8 uDEWrFXmtz4ydRSQsSiR3JcnF+t3J+on7EgQPOIrtG6R4eo38TyUj3MnbjPb/fC63S I9d7exYgRrvuWKFTBSvU1KrxtdD0U9gKCdpkbw1U= Subject: Re: [PATCH] strict policy patches To: Russell Coker , selinux-refpolicy@vger.kernel.org References: From: Daniel Burgener Message-ID: Date: Mon, 11 Oct 2021 12:12:42 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Thunderbird/68.12.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org > =================================================================== > --- refpolicy-2.20210908.orig/policy/modules/system/systemd.te > +++ refpolicy-2.20210908/policy/modules/system/systemd.te > @@ -65,10 +65,6 @@ type systemd_activate_t; > type systemd_activate_exec_t; > init_system_domain(systemd_activate_t, systemd_activate_exec_t) > > -type systemd_analyze_t; > -type systemd_analyze_exec_t; > -init_daemon_domain(systemd_analyze_t, systemd_analyze_exec_t) > - > type systemd_backlight_t; > type systemd_backlight_exec_t; > init_system_domain(systemd_backlight_t, systemd_backlight_exec_t) I proposed a similar change last year here and the consensus in the PR discussion was that it would make more sense to add policy for the systemd_analyze_t domain for cases that wanted a transition there, but keeping the general approach of running in the parent domain. https://github.com/SELinuxProject/refpolicy/pull/321 Of course, no one has actually submitted systemd_analyze_t policy yet, so maybe the demand for such a use case isn't all that high? -Daniel