Add set-root-password command

The `set-root-password` command sets up an alternate mount namespace
with a writable `/etc` directory and then runs `passwd` in it.  This
allows `passwd` to create its lock files and backup files, without
requiring that the real `/etc` to be mutable.  After `passwd` finishes
and has updated its private copy of `/etc/shadow`, the script rewrites
the real one with its contents.

repos/aimee-os/sec-policy/selinux-aimee-os/files/aimee-os.fc

@@ -1,4 +1,5 @@
 /usr/bin/system-update		--	gen_context(system_u:object_r:aimee_sysupdate_exec_t,s0)
+/usr/bin/set-root-password	--	gen_context(system_u:object_r:aimee_set_root_password_exec_t,s0)
 /usr/libexec/factory-reset	--	gen_context(system_u:object_r:aimee_factory_reset_exec_t,s0)
 /usr/libexec/init-storage	--	gen_context(system_u:object_r:aimee_storinit_exec_t,s0)
 

repos/aimee-os/sec-policy/selinux-aimee-os/files/aimee-os.if

@@ -45,3 +45,91 @@ interface(`aimee_os_run_system_update',`
 	aimee_os_system_update_domtrans($1)
 	role $2 types aimee_sysupdate_t;
 ')
+
+########################################
+## <summary>
+##	Execute set-root-password in the
+##	aimee_set_root_password_t domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`aimee_os_set_root_password_domtrans',`
+	gen_require(`
+		type aimee_set_root_password_t, aimee_set_root_password_exec_t;
+	')
+
+	domtrans_pattern($1, aimee_set_root_password_exec_t, aimee_set_root_password_t)
+')
+
+########################################
+## <summary>
+##	Execute set-root-password in the
+##	aimee_set_root_password_t domain, and
+##	allow the specified role the
+##	aimee_set_root_password_t domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`aimee_os_run_set_root_password',`
+	gen_require(`
+		type aimee_set_root_password_t;
+	')
+
+	aimee_os_set_root_password_domtrans($1)
+	role $2 types aimee_set_root_password_t;
+	mount_run(aimee_set_root_password_t, $2)
+')
+
+########################################
+## <summary>
+##	Execute set-root-password in the caller
+##	domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`aimee_os_set_root_password_exec',`
+	gen_require(`
+		type aimee_set_root_password_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, aimee_set_root_password_exec_t)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete temporary
+##	files used by Aimee OS set-root-password.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`aimee_os_manage_set_root_password_tmp_files',`
+	gen_require(`
+		type aimee_set_root_password_tmp_t;
+	')
+
+	manage_files_pattern($1, aimee_set_root_password_tmp_t, aimee_set_root_password_tmp_t)
+	read_lnk_files_pattern($1, aimee_set_root_password_tmp_t, aimee_set_root_password_tmp_t)
+')

repos/aimee-os/sec-policy/selinux-aimee-os/files/aimee-os.te

@@ -23,6 +23,13 @@ type aimee_factory_reset_t;
 type aimee_factory_reset_exec_t;
 init_daemon_domain(aimee_factory_reset_t, aimee_factory_reset_exec_t)
 
+type aimee_set_root_password_t;
+type aimee_set_root_password_exec_t;
+userdom_user_application_domain(aimee_set_root_password_t, aimee_set_root_password_exec_t)
+
+type aimee_set_root_password_tmp_t;
+files_tmp_file(aimee_set_root_password_tmp_t)
+
 ########################################
 #
 # init-storage local policy
@@ -198,6 +205,64 @@ fstools_manage_runtime_files(aimee_factory_reset_t)
 miscfiles_read_localization(aimee_factory_reset_t)
 storage_raw_rw_fixed_disk(aimee_factory_reset_t)
 
+########################################
+#
+# set-root-password local policy
+#
+
+gen_require(`
+	class passwd { passwd };
+')
+
+allow aimee_set_root_password_t self:capability { sys_admin };
+allow aimee_set_root_password_t self:fifo_file rw_fifo_file_perms;
+allow aimee_set_root_password_t self:process setfscreate;
+allow aimee_set_root_password_t self:process { ptrace sigkill sigstop signal };
+allow aimee_set_root_password_t self:passwd passwd;
+
+files_tmp_filetrans(aimee_set_root_password_t, aimee_set_root_password_tmp_t, dir)
+manage_dirs_pattern(aimee_set_root_password_t, aimee_set_root_password_tmp_t, aimee_set_root_password_tmp_t)
+manage_files_pattern(aimee_set_root_password_t, aimee_set_root_password_tmp_t, aimee_set_root_password_tmp_t)
+relabel_files_pattern(aimee_set_root_password_t, aimee_set_root_password_tmp_t, aimee_set_root_password_tmp_t)
+
+domain_use_interactive_fds(aimee_set_root_password_t)
+userdom_use_inherited_user_terminals(aimee_set_root_password_t)
+userdom_search_user_home_dirs(aimee_set_root_password_t)
+corecmd_exec_bin(aimee_set_root_password_t)
+selinux_get_fs_mount(aimee_set_root_password_t)
+seutil_read_config(aimee_set_root_password_t)
+miscfiles_read_localization(aimee_set_root_password_t)
+files_mounton_root(aimee_set_root_password_t)
+aimee_os_set_root_password_exec(aimee_set_root_password_t)
+mount_list_runtime(aimee_set_root_password_t)
+fs_getattr_all_fs(aimee_set_root_password_t)
+fs_mount_all_fs(aimee_set_root_password_t)
+fs_unmount_all_fs(aimee_set_root_password_t)
+files_read_var_lib_files(aimee_set_root_password_t)
+files_manage_etc_files(aimee_set_root_password_t)
+files_relabel_etc_files(aimee_set_root_password_t)
+files_manage_etc_dirs(aimee_set_root_password_t)
+auth_manage_shadow(aimee_set_root_password_t)
+auth_relabel_shadow(aimee_set_root_password_t)
+files_mounton_etc_dirs(aimee_set_root_password_t)
+usermanage_domtrans_passwd(aimee_set_root_password_t)
+dev_read_sysfs(aimee_set_root_password_t)
+aimee_os_manage_set_root_password_tmp_files(aimee_set_root_password_t)
+
+gen_require(`
+	type mount_t;
+	type passwd_t;
+')
+allow aimee_set_root_password_t aimee_set_root_password_tmp_t:dir mounton;
+allow mount_t aimee_set_root_password_tmp_t:dir mounton;
+aimee_os_manage_set_root_password_tmp_files(passwd_t)
+
+gen_require(`
+	type sysadm_t;
+	role sysadm_r;
+')
+aimee_os_run_set_root_password(sysadm_t, sysadm_r)
+
 ########################################
 #
 # Additional policy rules for Aimee OS-specific behavior