From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CF0DC10F11 for ; Sat, 13 Apr 2019 07:51:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0969C20869 for ; Sat, 13 Apr 2019 07:51:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="No32NI9F" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726285AbfDMHvu (ORCPT ); Sat, 13 Apr 2019 03:51:50 -0400 Received: from mail-ed1-f68.google.com ([209.85.208.68]:46988 "EHLO mail-ed1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725776AbfDMHvu (ORCPT ); Sat, 13 Apr 2019 03:51:50 -0400 Received: by mail-ed1-f68.google.com with SMTP id d1so10278751edd.13 for ; Sat, 13 Apr 2019 00:51:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to:user-agent; bh=7aauqwwroRb3smW7/YR06dZ74zplYkLOtoeybu54y6s=; b=No32NI9FIMIAcAAbSbWlQz4hFXP7j7Y+adAcy5MOT4zTrGkL7qUj+pKDd4qn64+qKK TQ2Fo4wkNmDNs71wZkEAscLa16s6OStUoUBb+RACAPvQ7EcP3FpEHZIzNOSKNWsa49X2 9e/8JDB3U2cB5pooBmK69ksK/DRbgZ9ue07NBLqbTDgNjjGbNAc/U4Bf2wR76vi7vngI OaScw800vy7Ad3ZcesTYn4USwtWIhefHEGbud+E4HSOWsML/oG3iNeGzh576cx6kgeev 9+RDXsSaf9Ik6KczfT7xvqIRyRgyT6ufxcKDjie6/X+XkE6Ae/j6LdIezttiB1CX2vO5 ztZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to:user-agent; bh=7aauqwwroRb3smW7/YR06dZ74zplYkLOtoeybu54y6s=; b=k/5ZzKbda/Lq9gW+puY14TgQU4Zy6/dBeYLCWfLbgatGHIsj4ueMF/nKHnrIZYr2Mx s8Mq4CPEyJORQexDF9PLnnUA3pn3JygLWpqfTo++EY/4dkdVFQVoEJGw5MOY4zd+N/KD bA9oOmxmmuvGR4Wy73TGNnjAO0J1ZD5vjAf0Ne3Bpdb75CuK40/6cQVrmBddx4NDxpzg RP3saebI8hMBZcgUN/1yil0LNH5kkDAmgxKrLLXvS+kmeqshha1GmBH0uxgY3ubaGmFO T19vfD/0eE1gjjbTHUxynso8YkzeO9uVCoQNQ69DWwxBC/MA8Fgj5wBj0MyVLY0dQ1dB GCrA== X-Gm-Message-State: APjAAAUkodBC3PSPpe2fh61DYUC4od1YYPg14eiPTWNn0HI6QgKZC6FW iYc8jtBlBSiAsApPJPLd58U= X-Google-Smtp-Source: APXvYqyecL2Fh18UD5ALn5naey3CZ/HarozCRIJr6p8wL/rqDjP20yfkCr3R0npOSM9RxVGjwZUcew== X-Received: by 2002:a50:aa4e:: with SMTP id p14mr38306631edc.59.1555141908097; Sat, 13 Apr 2019 00:51:48 -0700 (PDT) Received: from brutus.lan (brutus.defensec.nl. [2001:985:d55d::438]) by smtp.gmail.com with ESMTPSA id w6sm8126416ejq.73.2019.04.13.00.51.46 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sat, 13 Apr 2019 00:51:47 -0700 (PDT) Date: Sat, 13 Apr 2019 09:51:44 +0200 From: Dominick Grift To: Russell Coker Cc: "Sugar, David" , "selinux-refpolicy@vger.kernel.org" Subject: Re: [PATCH 2/3] Changes to support plymouth working in enforcing Message-ID: <20190413075144.GA5901@brutus.lan> Mail-Followup-To: Russell Coker , "Sugar, David" , "selinux-refpolicy@vger.kernel.org" References: <20190412193917.23886-1-dsugar@tresys.com> <2123404.RoTncvGGnz@liv> <3a5203d1-da92-4549-9a71-0055691e92be@tresys.com> <10127256.WPnezCvjeA@xev> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="gKMricLos+KVdGMg" Content-Disposition: inline In-Reply-To: <10127256.WPnezCvjeA@xev> User-Agent: Every email client sucks, this one just sucks less. X-PGP-Key: https://sks-keyservers.net/pks/lookup?op=get&search=0x3B6C5F1D2C7B6B02 Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org --gKMricLos+KVdGMg Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Apr 13, 2019 at 02:24:45PM +1000, Russell Coker wrote: > On Saturday, 13 April 2019 1:23:15 PM AEST Sugar, David wrote: > > On 4/12/19 10:43 PM, Russell Coker wrote: > >=20 > > > On Saturday, 13 April 2019 5:39:31 AM AEST Sugar, David wrote: > > >=20 > > >> plymouth is started very early in the boot process. Looks > > >> like before the SELinux policy is loaded so plymouthd is > > >> running as kernel_t rather than plymouthd_t. Due to this > > >> I needed to allow a few permissions on kernel_t to get > > >> the system to boot. > > >=20 > > >=20 > > > Could plymouth re-exec itself or do a dynamic domain transition to get > > > the > > > right domain? > > >=20 > >=20 > >=20 > > I don't see a way in the plymouth.conf or other configuration file to= =20 > > have plymouth re-exec. >=20 > Probably need to hack the plymouth source. Not sure if it is worth the trouble, plymouthd mainly runs in the initramfs. There's a couple of left-overs when systemd loads policy but that is it AFA= IK. >=20 > --=20 > My Main Blog http://etbe.coker.com.au/ > My Documents Blog http://doc.coker.com.au/ >=20 --=20 Key fingerprint =3D 5F4D 3CDB D3F8 3652 FBD8 02D5 3B6C 5F1D 2C7B 6B02 https://sks-keyservers.net/pks/lookup?op=3Dget&search=3D0x3B6C5F1D2C7B6B02 Dominick Grift --gKMricLos+KVdGMg Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAEBCAAdFiEEujmXliIBLFTc2Y4AJXSOVTf5R2kFAlyxlQwACgkQJXSOVTf5 R2kWmwwAnBm32By/Ua51JKrVxu3F1dweFI5hi+RVhoF8cR/e5yCyxMvH3Sls4FZk W4oGizeVY7n1D1PLQNyrdR2HPk4H0MZy3MAWQwf0lolhDy/OORmBS6sM8j0PI+wo M3FZql4XlREl94GLGyiMiZTQlG5cFA+axRm7SrLn/W0qT1T14jEKkqH6xD+v1PHE 8Wb5Tr6EkhNAQMNg6qteo9MCSX/ifvZZvOhw1nN4LxtMECW7yWgUtYlDyaDG85Qy z6ZXBnppnYt7FYu0bDhgTMJdcTgqJ6kBFqT1WRTDyqXh20ao6oPC7wV/7qKXJJQA AuWi0BtLVATvI6nK8XhIydwOBbywKtMIoVTluObOGmeHm4+1aXIoDH0detFjU8Q/ IEjV/1YWfOVLK6ZwyYcDWyfJQlqEY0WHTf96xXITN2WVU/ejMHCgtZDYHbch8KdV fOsFzt+A3660PIObEwMWBbtES374qVFODUwwLzKdrt5+LPCc9B88cz/eMKkePRwi TJ5OrBzM =N1tc -----END PGP SIGNATURE----- --gKMricLos+KVdGMg--