I'd like to refine how the policy handles systemd's mounton so that it
works similar to how we manage mountpoints for mount_t. Since systemd
can be made to mount over just about anything, I'm looking at adding a
new conditional that would allow init_t to mounton
non_security_file_type, and then an interface like files_mountpoint().
The question is for the implementation of the interface; I see two
options, either the interface allows mounton for all file-like classes,
or the classes are specified as a parameter:
--------
init.te:
attribute init_mountpoint_type;
allow init_t init_mountpoint_type:dir_file_class_set mounton;
init.if:
interface(`init_mountpoint',`
typeattribute $1 init_mountpoint_type;
')
--------
or
--------
init.if:
interface(`init_mountpoint',`
allow init_t $1:$2 mounton;
')
--------
I like the first option because it is clearer since you can see the
mounton in init.te, but that is excessive access. The second option
could be made to look like the first option, but it would need several
attributes and interfaces, e.g. init_dir_mountpoint_type,
init_file_mountpoint_type, etc. which isn't so desirable.
Any thoughts on this?
--
Chris PeBenito
