commit:     60d89770b45fce6ae0eefabbbbebd1fbaa717eea
Author:     David Sugar <dsugar <AT> tresys <DOT> com>
AuthorDate: Fri Dec  8 22:30:58 2017 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Dec 12 07:06:27 2017 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=60d89770

label systemd-shutdown so shutdown works

I am seeing (on RHEL 7.4 w/systemd) that halting the system doesn't work.  It 
took me a long time (and a lot of help from Steve L.) to figure out what was 
going on.  It turns out in refpolicy the default label for 
/usr/lib/systemd/systemd-shutdown is bin_t.  But when systemd tried to execve 
systemd-shutdown it fails because init_t isn't allowed file entrypoint for 
bin_t.  When I labeled systemd-shutdown as init_exec_t shutting down the system 
works.

I was seeing the following log (from systemd) when I enabled systemd debug 
logging (which was very useful).

[   59.745037] systemd[1]: Starting Final Step.
[   59.746112] systemd[1]: Starting Power-Off...
[   59.776320] systemd[1]: Shutting down.
[   59.783559] systemd[1]: Failed to execute shutdown binary, freezing: 
Operation not permitted

At this point everything locks up instead of actually halting the system.

This is a patch to change the label for systemd-shutdown which solves the 
problem.  I'm happy to go through and make a distinct type of systemd-shutdown 
if someone doesn't think it is a good idea to share the type with systemd.  But 
based on what is going on, this might be reasonable.

Signed-off-by: Dave Sugar <dsugar <AT> tresys.com>

 policy/modules/system/init.fc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index d029ea30..bf0acaf9 100644
--- a/policy/modules/system/init.fc
+++ b/policy/modules/system/init.fc
@@ -29,6 +29,7 @@ ifdef(`distro_gentoo',`
 /usr/bin/upstart       --      gen_context(system_u:object_r:init_exec_t,s0)
 
 /usr/lib/systemd/systemd --    gen_context(system_u:object_r:init_exec_t,s0)
+/usr/lib/systemd/systemd-shutdown      --      
gen_context(system_u:object_r:init_exec_t,s0)
 /usr/lib/systemd/system-preset(/.*)? 
gen_context(system_u:object_r:systemd_unit_t,s0)
 /usr/lib/systemd/user-preset(/.*)? 
gen_context(system_u:object_r:systemd_unit_t,s0)
 /usr/lib/systemd/ntp-units\.d -d 
gen_context(system_u:object_r:systemd_unit_t,s0)

Reply via email to