I need a script invoked from procmail_t to run unconfined.

[Robert Nichols]

On 05/06/2013 11:40 AM, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 05/02/2013 05:53 PM, Robert Nichols wrote:
>> On 05/02/2013 12:58 AM, Miroslav Grepl wrote:
>>> I would go with a different way and create a new domain -
>>> procmail_unconfined_t and make this domain as unconfined domain.
>>>
>>> # cat myprocmail.te
>>>
>>> require{ type procmail_t; }
>>>
>>> type procmail_unconfined_exec_t;
>>> application_executable_file(procmail_unconfined_exec_t)
>>>
>>> optional_policy(` type procmail_unconfined_t;
>>> domain_type(procmail_unconfined_t)
>>>
>>> domain_entry_file(procmail_unconfined_t, procmail_unconfined_exec_t) role
>>> system_r types procmail_unconfined_t;
>>>
>>> domtrans_pattern(procmail_t, procmail_unconfined_exec_t,
>>> procmail_unconfined_t)
>>>
>>> allow procmail_t procmail_unconfined_exec_t:dir search_dir_perms; allow
>>> procmail_t procmail_unconfined_exec_t:dir read_file_perms; allow
>>> procmail_t procmail_unconfined_exec_t:file ioctl;
>>>
>>> init_domtrans_script(procmail_unconfined_t)
>>>
>>> optional_policy(` unconfined_domain(procmail_unconfined_t) ') ')
>>>
>>> # make -f /usr/share/selinux/devel/Makefile mytest.pp # sudo semodule -i
>>> mytest.pp # chcon -t procmail_unconfined_exec_t PATH_TO_YOU_SCRIPTS
>>
>> Thanks, I _think_ that's basically what I ended up doing. [copied from my
>> previous post]:
>>
>> policy_module(procmail_uncon, 1.0.18)
>>
>> gen_require(` type unconfined_t; type unconfined_exec_t; type procmail_t;
>> role system_r; ')
>>
>> type my_uncon_exec_t; files_type(my_uncon_exec_t)
>>
>> allow procmail_t unconfined_t : process { transition sigchld };
>> domain_auto_trans(procmail_t, my_uncon_exec_t, unconfined_t) role system_r
>> types unconfined_t;
>>
> One difference between what Miroslav showed and you did, was that your new
> domain is now unconfined_t and might transition to another domain.  Whereas
> his would not, also any confined domain that was allowed to communicate with
> unconfined_t would be able t communicate with your domain.  They would not in
> Mirsoslav's case.

Then I'll definitely stick with what I've got since it makes everything work
the same way it does when I invoke procmail from the command line.  procmail
transitions to procmail_t only when invoked from certain other confined
domains, and that is a large part of what was making my life difficult in
testing.  Now, my script runs the same whether procmail was running in
domain procmail_t or unconfined_t.

-- 
Bob Nichols     "NOSPAM" is really part of my email address.
                 Do NOT delete it.