* [refpolicy] [PATCH 1/1] Allow udev to launch init scripts (f.i. on network module load)
@ 2011-02-02 18:20 Sven Vermeulen
2011-02-02 18:23 ` Daniel J Walsh
0 siblings, 1 reply; 6+ messages in thread
From: Sven Vermeulen @ 2011-02-02 18:20 UTC (permalink / raw)
To: refpolicy
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
policy/modules/system/udev.te | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index a054cf5..2deaa0d 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -175,6 +175,7 @@ ifdef(`distro_gentoo',`
# during boot, init scripts use /dev/.rcsysinit
# existance to determine if we are in early booting
init_getattr_script_status_files(udev_t)
+ init_domtrans_script(udev_t)
')
ifdef(`distro_redhat',`
--
1.7.3.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH 1/1] Allow udev to launch init scripts (f.i. on network module load)
2011-02-02 18:20 [refpolicy] [PATCH 1/1] Allow udev to launch init scripts (f.i. on network module load) Sven Vermeulen
@ 2011-02-02 18:23 ` Daniel J Walsh
2011-02-02 18:38 ` Sven Vermeulen
0 siblings, 1 reply; 6+ messages in thread
From: Daniel J Walsh @ 2011-02-02 18:23 UTC (permalink / raw)
To: refpolicy
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/02/2011 01:20 PM, Sven Vermeulen wrote:
>
> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> ---
> policy/modules/system/udev.te | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
> index a054cf5..2deaa0d 100644
> --- a/policy/modules/system/udev.te
> +++ b/policy/modules/system/udev.te
> @@ -175,6 +175,7 @@ ifdef(`distro_gentoo',`
> # during boot, init scripts use /dev/.rcsysinit
> # existance to determine if we are in early booting
> init_getattr_script_status_files(udev_t)
> + init_domtrans_script(udev_t)
> ')
>
> ifdef(`distro_redhat',`
This would be better if it specified which scripts were launched.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1JoT8ACgkQrlYvE4MpobO9SQCfSbILR47E1hpK2sJWubG49cvN
8P0AnRMAP+kgQz3q7juwWtQRSiA3flLv
=3mqv
-----END PGP SIGNATURE-----
^ permalink raw reply [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH 1/1] Allow udev to launch init scripts (f.i. on network module load)
2011-02-02 18:23 ` Daniel J Walsh
@ 2011-02-02 18:38 ` Sven Vermeulen
2011-02-14 13:41 ` Christopher J. PeBenito
0 siblings, 1 reply; 6+ messages in thread
From: Sven Vermeulen @ 2011-02-02 18:38 UTC (permalink / raw)
To: refpolicy
On Wed, Feb 02, 2011 at 01:23:59PM -0500, Daniel J Walsh wrote:
> > --- a/policy/modules/system/udev.te
> > +++ b/policy/modules/system/udev.te
> > @@ -175,6 +175,7 @@ ifdef(`distro_gentoo',`
> > # during boot, init scripts use /dev/.rcsysinit
> > # existance to determine if we are in early booting
> > init_getattr_script_status_files(udev_t)
> > + init_domtrans_script(udev_t)
> > ')
> >
> > ifdef(`distro_redhat',`
>
> This would be better if it specified which scripts were launched.
Definitely. Was wondering why git send-email didn't ask me for more
information ;-) Anyhow, thanks for your tips in #selinux, now for the
requested information...
In Gentoo (the patch only includes the line in a distro_gentoo section), the
(default installed) 90-network.rules calls the /etc/init.d/net.<interface>
init script when a network subsystem is added or removed.
Wkr,
Sven Vermeulen
^ permalink raw reply [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH 1/1] Allow udev to launch init scripts (f.i. on network module load)
2011-02-02 18:38 ` Sven Vermeulen
@ 2011-02-14 13:41 ` Christopher J. PeBenito
2011-02-14 18:51 ` Sven Vermeulen
0 siblings, 1 reply; 6+ messages in thread
From: Christopher J. PeBenito @ 2011-02-14 13:41 UTC (permalink / raw)
To: refpolicy
On 2/2/2011 1:38 PM, Sven Vermeulen wrote:
> On Wed, Feb 02, 2011 at 01:23:59PM -0500, Daniel J Walsh wrote:
>>> --- a/policy/modules/system/udev.te
>>> +++ b/policy/modules/system/udev.te
>>> @@ -175,6 +175,7 @@ ifdef(`distro_gentoo',`
>>> # during boot, init scripts use /dev/.rcsysinit
>>> # existance to determine if we are in early booting
>>> init_getattr_script_status_files(udev_t)
>>> + init_domtrans_script(udev_t)
>>> ')
>>>
>>> ifdef(`distro_redhat',`
>>
>> This would be better if it specified which scripts were launched.
>
> Definitely. Was wondering why git send-email didn't ask me for more
> information ;-) Anyhow, thanks for your tips in #selinux, now for the
> requested information...
>
> In Gentoo (the patch only includes the line in a distro_gentoo section), the
> (default installed) 90-network.rules calls the /etc/init.d/net.<interface>
> init script when a network subsystem is added or removed.
I believe he is saying that the scripts should be labeled, not that
you're missing a description (though thats important too).
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH 1/1] Allow udev to launch init scripts (f.i. on network module load)
2011-02-14 13:41 ` Christopher J. PeBenito
@ 2011-02-14 18:51 ` Sven Vermeulen
2011-02-16 14:28 ` Christopher J. PeBenito
0 siblings, 1 reply; 6+ messages in thread
From: Sven Vermeulen @ 2011-02-14 18:51 UTC (permalink / raw)
To: refpolicy
On Mon, Feb 14, 2011 at 08:41:54AM -0500, Christopher J. PeBenito wrote:
> > In Gentoo (the patch only includes the line in a distro_gentoo section), the
> > (default installed) 90-network.rules calls the /etc/init.d/net.<interface>
> > init script when a network subsystem is added or removed.
>
> I believe he is saying that the scripts should be labeled, not that
> you're missing a description (though thats important too).
Well, the /etc/init.d/net.<interface> scripts are symlinks to a script
labelled initrc_exec_t as one would imagine from an init script. udev itself
(running in udev_t domain) calls a wrapper script net.sh (labelled bin_t).
You'd rather see this wrapper script be labelled something like
udev_net_exec_t which transitions to udev_net_t which then calls the
net.<interface> script (initrc_exec_t) which transitions to initrc_t ?
Wkr,
Sven Vermeulen
^ permalink raw reply [flat|nested] 6+ messages in thread
* [refpolicy] [PATCH 1/1] Allow udev to launch init scripts (f.i. on network module load)
2011-02-14 18:51 ` Sven Vermeulen
@ 2011-02-16 14:28 ` Christopher J. PeBenito
0 siblings, 0 replies; 6+ messages in thread
From: Christopher J. PeBenito @ 2011-02-16 14:28 UTC (permalink / raw)
To: refpolicy
On 02/14/11 13:51, Sven Vermeulen wrote:
> On Mon, Feb 14, 2011 at 08:41:54AM -0500, Christopher J. PeBenito wrote:
>>> In Gentoo (the patch only includes the line in a distro_gentoo section), the
>>> (default installed) 90-network.rules calls the /etc/init.d/net.<interface>
>>> init script when a network subsystem is added or removed.
>>
>> I believe he is saying that the scripts should be labeled, not that
>> you're missing a description (though thats important too).
>
> Well, the /etc/init.d/net.<interface> scripts are symlinks to a script
> labelled initrc_exec_t as one would imagine from an init script. udev itself
> (running in udev_t domain) calls a wrapper script net.sh (labelled bin_t).
>
> You'd rather see this wrapper script be labelled something like
> udev_net_exec_t which transitions to udev_net_t which then calls the
> net.<interface> script (initrc_exec_t) which transitions to initrc_t ?
Making something like network_initrc_exec_t and labeling all the basic
networking scripts with it, and then transitioning to initrc_t is what
we mean.
--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-02-16 14:28 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-02-02 18:20 [refpolicy] [PATCH 1/1] Allow udev to launch init scripts (f.i. on network module load) Sven Vermeulen
2011-02-02 18:23 ` Daniel J Walsh
2011-02-02 18:38 ` Sven Vermeulen
2011-02-14 13:41 ` Christopher J. PeBenito
2011-02-14 18:51 ` Sven Vermeulen
2011-02-16 14:28 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.