allow $1_systemd_t $2:process noatsecure;

https://github.com/SELinuxProject/refpolicy/pull/999

In the above PR I have a template as follows:

+######################################
+## <summary>
+##   Allow the specified domain to not have the atsecure setting when started
+##   as a daemon by the specified systemd user instance
+## </summary>
+## <param name="prefix">
+##     <summary>
+##     Prefix for the user domain.
+##     </summary>
+## </param>
+## <param name="domain">
+##     <summary>
+##     Domain that is entered with noatsecure
+##     </summary>
+## </param>
+#
+template(`systemd_user_daemon_domain_noatsecure',`
+       gen_require(`
+               type $1_systemd_t;
+       ')
+
+       allow $1_systemd_t $2:process noatsecure;
+')

I have that called from the template dbus_role_template with the following 
(adjusted for word wrap):

+               # dbus-broker-launch fails with no media on sd_bus_open_user() 
+               # without this
+               systemd_user_daemon_domain_noatsecure($1, $1_dbusd_t)

So far this has been the only case I've found for needing noatsecure.

Pebenito said:
> I think this perm should be default for anything that systemd --user is
> running, same as with pid1.

With the justification of:
> Because, as with system units, you can specify environment variables in user
> units.

I don't object to this, but I'm hesitant to change my PR to include things 
with this sort of scope that I haven't found a need for.  I would like some 
comments from other members of this list.  For reference the below URL has the 
background to this:

https://blog.siphos.be/2011/04/selinux-and-noatsecure-or-why-portage-complains-about-ld_preload-and-libsandbox-so/

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/