From 418b3c78bb7198af5e4d05cdfd569bb2c002f300 Mon Sep 17 00:00:00 2001 From: Steve Lawrence Date: Wed, 3 Dec 2014 09:55:26 -0500 Subject: [PATCH] Update policy for selinux userspace moving the policy store to /var/lib/selinux With the new userspace, the only files in /var/lib/selinux are selinux store related files, so label it and everything inside it as semanage_store_t. semanage_var_lib_t is completely removed and now aliases semanage_store_t for backwards compatibility. This differs from the v2 patch in that it adds back the ability to manage selinux_config_t, which is necessary to manage the old module store for things like migrating from the old to new store and backwards compatability. Signed-off-by: Steve Lawrence --- policy/modules/system/selinuxutil.fc | 5 ++++- policy/modules/system/selinuxutil.if | 2 ++ policy/modules/system/selinuxutil.te | 8 +------- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/policy/modules/system/selinuxutil.fc b/policy/modules/system/selinuxutil.fc index ec19d63db..7616b318b 100644 --- a/policy/modules/system/selinuxutil.fc +++ b/policy/modules/system/selinuxutil.fc @@ -41,11 +41,14 @@ /usr/sbin/setsebool -- gen_context(system_u:object_r:semanage_exec_t,s0) /usr/sbin/semanage -- gen_context(system_u:object_r:semanage_exec_t,s0) /usr/sbin/semodule -- gen_context(system_u:object_r:semanage_exec_t,s0) +/usr/libexec/selinux/semanage_migrate_store -- gen_context(system_u:object_r:semanage_exec_t,s0) # # /var/lib # -/var/lib/selinux(/.*)? gen_context(system_u:object_r:semanage_var_lib_t,s0) +/var/lib/selinux(/.*)? gen_context(system_u:object_r:semanage_store_t,s0) +/var/lib/selinux/[^/]+/semanage\.read\.LOCK -- gen_context(system_u:object_r:semanage_read_lock_t,s0) +/var/lib/selinux/[^/]+/semanage\.trans\.LOCK -- gen_context(system_u:object_r:semanage_trans_lock_t,s0) # # /var/run diff --git a/policy/modules/system/selinuxutil.if b/policy/modules/system/selinuxutil.if index bee06f420..129a6e0b0 100644 --- a/policy/modules/system/selinuxutil.if +++ b/policy/modules/system/selinuxutil.if @@ -1041,7 +1041,9 @@ interface(`seutil_manage_module_store',` ') files_search_etc($1) + files_search_var($1) manage_dirs_pattern($1, selinux_config_t, semanage_store_t) + manage_dirs_pattern($1, semanage_store_t, semanage_store_t) manage_files_pattern($1, semanage_store_t, semanage_store_t) manage_lnk_files_pattern($1, semanage_store_t, semanage_store_t) ') diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index c322a6f65..43cf82d07 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -100,7 +100,7 @@ application_domain(semanage_t, semanage_exec_t) domain_interactive_fd(semanage_t) role semanage_roles types semanage_t; -type semanage_store_t; +type semanage_store_t alias semanage_var_lib_t; files_type(semanage_store_t) type semanage_read_lock_t; @@ -112,9 +112,6 @@ files_tmp_file(semanage_tmp_t) type semanage_trans_lock_t; files_type(semanage_trans_lock_t) -type semanage_var_lib_t; -files_type(semanage_var_lib_t) - type setfiles_t alias restorecon_t, can_relabelto_binary_policy; type setfiles_exec_t alias restorecon_exec_t; init_system_domain(setfiles_t, setfiles_exec_t) @@ -454,9 +451,6 @@ allow semanage_t semanage_tmp_t:dir manage_dir_perms; allow semanage_t semanage_tmp_t:file manage_file_perms; files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir }) -manage_dirs_pattern(semanage_t, semanage_var_lib_t, semanage_var_lib_t) -manage_files_pattern(semanage_t, semanage_var_lib_t, semanage_var_lib_t) - kernel_read_system_state(semanage_t) kernel_read_kernel_sysctls(semanage_t)