RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

label systemd-shutdown so shutdown works 

I am seeing (on RHEL 7.4 w/systemd) that halting the system doesn't work.  It took me a long time (and a lot of help from Steve L.) to figure out what was going on.  It turns out in refpolicy the default label for /usr/lib/systemd/systemd-shutdown is bin_t.  But when systemd tried to execve systemd-shutdown it fails because init_t isn't allowed file entrypoint for bin_t.  When I labeled systemd-shutdown as init_exec_t shutting down the system works.

I was seeing the following log (from systemd) when I enabled systemd debug logging (which was very useful).

[   59.745037] systemd[1]: Starting Final Step.
[   59.746112] systemd[1]: Starting Power-Off...
[   59.776320] systemd[1]: Shutting down.
[   59.783559] systemd[1]: Failed to execute shutdown binary, freezing: Operation not permitted

At this point everything locks up instead of actually halting the system.

This is a patch to change the label for systemd-shutdown which solves the problem.  I'm happy to go through and make a distinct type of systemd-shutdown if someone doesn't think it is a good idea to share the type with systemd.  But based on what is going on, this might be reasonable.

Signed-off-by: Dave Sugar <dsugar@tresys.com>
This commit is contained in:
David Sugar 2017-12-08 22:30:58 +00:00 committed by Chris PeBenito
parent 7d910a92d4
commit 8a7a8bd8c8
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/system/init.fc
View File

@ -29,6 +29,7 @@ ifdef(`distro_gentoo',`
/usr/bin/upstart -- gen_context(system_u:object_r:init_exec_t,s0)
/usr/lib/systemd/systemd -- gen_context(system_u:object_r:init_exec_t,s0)
/usr/lib/systemd/systemd-shutdown -- gen_context(system_u:object_r:init_exec_t,s0)
/usr/lib/systemd/system-preset(/.*)? gen_context(system_u:object_r:systemd_unit_t,s0)
/usr/lib/systemd/user-preset(/.*)? gen_context(system_u:object_r:systemd_unit_t,s0)
/usr/lib/systemd/ntp-units\.d -d gen_context(system_u:object_r:systemd_unit_t,s0)