[refpolicy] [PATCH 1/2] Fix OpenRC status dir labeling for Gentoo

[Chris Richards]

Current policy sets /lib(32|64)?/rc/init.d to lib_t.  This causes
problems for DHCP among other things, as the initrc domain does not
have permissions to perform some operations.  Changing to
initrc_state_t (the labeling used for /var/lib/init.d by
the older baselayout-1) resolves some of these issues.

Signed-off-by: Chris Richards <gizmo at giz-works.com>
---
 policy/modules/system/init.fc |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/policy/modules/system/init.fc b/policy/modules/system/init.fc
index 9775375..d79f336 100644
--- a/policy/modules/system/init.fc
+++ b/policy/modules/system/init.fc
@@ -66,3 +66,11 @@ ifdef(`distro_suse', `
 /var/run/sysconfig(/.*)?	gen_context(system_u:object_r:initrc_var_run_t,s0)
 ')
 
+#
+# /lib
+#
+ifdef(`distro_gentoo', `
+/lib/rc/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
+/lib32/rc/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
+/lib64/rc/init\.d(/.*)?		gen_context(system_u:object_r:initrc_state_t,s0)
+')
-- 
1.7.3.2