> Okay, but what is this "in-depth" change that I was talking about. Well, > SELinux policies support labeled init scripts. For instance, > "slapd_initrc_exec_t" which allows the init script to run in an init > script > domain specific for slapd (splad_initrc_t). This allows for slapd-specific > allow statements (for instance PID file management) from within the init > script. > > All fine, but Gentoo doesn't use that. We run all our scripts in initrc_t > instead. Why? Because we support "integrated run_init support", which > allows > our users to just call "/etc/init.d/slapd start" instead of "run_init > /etc/init.d/slapd start". But this integrated run_init support > automatically > transitions all scripts to initrc_t (and not slapd_initrc_t). And changing > this to support the named init scripts isn't straight forward (well, I > hope > I eventually find a straight-forward method, but until now I didn't > succeed). > > Yet we will eventually need to support this, because otherwise we need to > "open" the privileges on initrc_t towards all potential services. Not only > does that require lots of work, it also brings in patches in our policy > that > upstream will never accept (and they're right not to accept it).
Ok, I buy the argument. Is this a shortcoming in the old bash init, or is this a shortcoming in OpenRC? I'm starting to see a little more free time from my job and might be able to tackle some things starting in a couple of weeks. Gizmo
