How can I create an selinux policy to govern my systemd unit?
I am creating a daemon that will be managed by systemd and I'd like to create an appropriate selinux policy to go with it. I've tried creating my own policy either by hand or via a tool such as sepolicy generate
. But the process never transitions out of init_t
. I've also poked around using the systemd policy templates but I couldn't find any good examples to work off of. I feel I must be missing something basic, but I don't know what it could be.
sepolicy output
policy_module(foo, 1.0.0)
########################################
#
# Declarations
#
type foo_t;
type foo_exec_t;
init_daemon_domain(foo_t, foo_exec_t)
permissive foo_t;
########################################
#
# foo local policy
#
allow foo_t self:fifo_file rw_fifo_file_perms;
allow foo_t self:unix_stream_socket create_stream_socket_perms;
domain_use_interactive_fds(foo_t)
files_read_etc_files(foo_t)
miscfiles_read_localization(foo_t)
ls -lZ /usr/bin/foo
-rwxr-xr-x. root root unconfined_u:object_r:foo_exec_t:s0 /usr/bin/foo
ps axufZ
system_u:system_r:init_t:s0 foo 9983 2.0 0.0 113124 1408 ? Ss 14:37 0:00 /bin/bash /usr/bin/foo
0 Answers