[rpms/icecream] epel10.2: Label the wrappers as initrc_exec_t

[rpms/icecream] epel10.2: Label the wrappers as initrc_exec_t

[Michal Schmidt]

            A new commit has been pushed.

            Repo   : rpms/icecream
            Branch : epel10.2
            Commit : bfea8b989266d13616203b02117b9c37524dd54a
            Author : Michal Schmidt <mschmidt@redhat.com>
            Date   : 2016-11-04T16:28:48+01:00
            Stats  : +3/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/icecream/c/bfea8b989266d13616203b02117b9c37524dd54a?branch=epel10.2

            Log:
            Label the wrappers as initrc_exec_t

The previous attempt to fix the labelling was incorrect. The bin_t label
on the wrappers caused the services to run as unconfined_service_t.

Instead label the wrappers as initrc_exec_t.
systemd (init_t) runs the wrapper as initrc_t, which then execs the
binary and becomes iceccd_t / icecc_scheduler_t.

---
diff --git a/icecream.fc b/icecream.fc
index 0cdcdda..48b6d47 100644
--- a/icecream.fc
+++ b/icecream.fc
@@ -1,5 +1,7 @@
 /usr/sbin/iceccd                           -- gen_context(system_u:object_r:iceccd_exec_t,s0)
+/usr/libexec/icecc/iceccd-wrapper          -- gen_context(system_u:object_r:initrc_exec_t,s0)
 /usr/sbin/icecc-scheduler                  -- gen_context(system_u:object_r:icecc_scheduler_exec_t,s0)
+/usr/libexec/icecc/icecc-scheduler-wrapper -- gen_context(system_u:object_r:initrc_exec_t,s0)
 /usr/bin/icecc-create-env                  -- gen_context(system_u:object_r:iceccd_createenv_exec_t,s0)
 /var/cache/icecream(/.*)?                     gen_context(system_u:object_r:iceccd_cache_t,s0)
 /var/run/icecc(/.*)?                          gen_context(system_u:object_r:iceccd_var_run_t,s0)

diff --git a/icecream.te b/icecream.te
index 675e760..8c277d1 100644
--- a/icecream.te
+++ b/icecream.te
@@ -1,5 +1,5 @@
 
-policy_module(icecream,0.1.7)
+policy_module(icecream,0.1.8)
 
 ########################################
 #