Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 482196 - Support emerge --config in SELinux profiles
Summary: Support emerge --config in SELinux profiles
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Sven Vermeulen (RETIRED)
URL:
Whiteboard: sec-policy r3
Keywords:
Depends on:
Blocks:
 
Reported: 2013-08-23 10:02 UTC by Sven Vermeulen (RETIRED)
Modified: 2014-01-12 20:56 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sven Vermeulen (RETIRED) gentoo-dev 2013-08-23 10:02:01 UTC
Currently, emerge --config might not work as expected in SELinux profiles as emerge by default runs in the (confined) portage_t domain, whereas the pkg_config() phase of ebuilds generally require system administration privileges.

Reproducible: Always




Going to see if we can support emerge --config without transition while keeping portage_t for regular operations. Looks like this *might* work if /usr/lib/portage/bin/ebuild{.sh} are labeled bin_t instead of portage_exec_t, but that does mean that the developer "functionality" offered by those tools needs to be tackled.
Comment 1 Sven Vermeulen (RETIRED) gentoo-dev 2013-08-23 10:09:05 UTC
Looks like the "simplest" approach is that:

- Users who need to call "emerge --config" use runcon to force the domain to remain in sysadm_t
- The ebuild and ebuild.sh scripts are marked as bin_t
- Developers can call "ebuild" with runcon as well

Needed policy changes:

can_exec(sysadm_t, portage_tmp_t) # Portage does an exectest
allow portage_t bin_t:file entrypoint;

/usr/lib/portage/bin/ebuild{,.sh} marked as bin_t

Best is to document this in the Gentoo SELinux handbook (developers section or so)

Going to look for other possibilities now as well.
Comment 2 Sven Vermeulen (RETIRED) gentoo-dev 2013-09-26 17:32:45 UTC
r3 is now in the tree, ~arch'ed
Comment 3 Sven Vermeulen (RETIRED) gentoo-dev 2014-01-12 20:56:37 UTC
r4 is now stable in the tree