When executing a symlink'ed labeled init script, the following occurs: ~$ sudo /etc/init.d/ceph-mon.0 status openrc-run should not be run directly In the denials we notice: time->Sat Jul 11 15:24:53 2015 type=AVC msg=audit(1436621093.701:1165): avc: denied { read } for pid=30786 comm="openrc" name="ceph-mon.0" dev="vda3" ino=1966780 scontext=staff_u:staff_r:run_init_t:s0 tcontext=system_u:object_r:ceph_initrc_exec_t:s0 tclass=lnk_file permissive=0 Reproducible: Always
Suggested fix is to enhance init_read_all_script_files to allow reading the symlinks as well. Then grant this to the run_init_t domain for Gentoo specifically. diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if index ed65609..211d434 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -1195,6 +1195,11 @@ interface(`init_read_all_script_files',` files_search_etc($1) allow $1 init_script_file_type:file read_file_perms; + + ifdef(`distro_gentoo',` + # Bug 554514 + allow $1 init_script_file_type:lnk_file read_lnk_file_perms; + ') ') ####################################### diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te index 51c64be..d25a0fd 100644 --- a/policy/modules/system/selinuxutil.te +++ b/policy/modules/system/selinuxutil.te @@ -418,6 +418,8 @@ userdom_use_user_terminals(run_init_t) ifndef(`direct_sysadm_daemon',` ifdef(`distro_gentoo',` # Gentoo integrated run_init: + # Bug 554514 + init_read_all_script_files(run_init_t) init_script_file_entry_type(run_init_t) init_exec_rc(run_init_t)
Is in policy, will be in rev 8
r8 is in ~arch now
r8 is stable
