On 07/12/11 17:12, Daniel J Walsh wrote: > Currently we can setup certain domains to be allowed to execute labeled > init scripts. If we go away from init scripts we will need a mechanism > for init to look at the calling program label to figure out if it is > allowed to start/stop certain domains. > > Can webadm_t start/stop mysqld_t? Can webadm_t start/stop httpd_t? > > # id -Z > staff_u:webadm_r:webadm_t:s0-s0:c0.c1023 > # systemctl start httpd.service > # systemctl stop httpd.service > > Another option would be just whether label > /lib/systemd/system/mysqld.service something that webadm_t is not > allowed to read. > > Ideas? Does your suggestion really make it impossible to send a command to systemd to start/stop a service if you cant read that file (eg mysqld.service)? I don't know what the implementation is, but I would guess that systemctl connects to systemd over a unix socket or fifo to give commands? If so, it would seem better for systemd to have some SELinux awareness on its incoming commands. -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
