Create new xattrfs attribute and fs_getattr_all_xattr_fs() interface
PATCH v2 1/3 Create new xattrfs attribute and fs_getattr_all_xattr_fs() interface
From: Laurent Bigonville <[email protected]>
Create a new attribute and fs_getattr_all_xattr_fs() interface that will be used for all the filesystems that support xattr
--- policy/modules/kernel/filesystem.if | 58 +++++++++++++++++++++++++++++++++++++ policy/modules/kernel/filesystem.te | 1 + 2 files changed, 59 insertions(+)
policy/modules/kernel/filesystem.if +58 -0
@@ -108,6 +108,64 @@ interface(`fs_exec_noxattr',` ######################################## ## <summary> +## Transform specified type into a filesystem +## type which has extended attribute +## support. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`fs_xattr_type',` + gen_require(` + attribute xattrfs; + ') + + fs_type($1) + + typeattribute $1 xattrfs; +') + +######################################## +## <summary> +## Get the attributes of all the +## filesystems which have extended +## attributes. +## This includes pseudo filesystems. +## </summary> +## <desc> +## <p> +## Allow the specified domain to +## get the attributes of a filesystems +## which have extended attributes. +## Example attributes: +## </p> +## <ul> +## <li>Type of the file system (e.g., tmpfs)</li> +## <li>Size of the file system</li> +## <li>Available space on the file system</li> +## </ul> +## </desc> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <infoflow type="read" weight="5"/> +## <rolecap/> +# +interface(`fs_getattr_all_xattr_fs',` + gen_require(` + attribute xattrfs; + ') + + allow $1 xattrfs:filesystem getattr; +') + +######################################## +## <summary> ## Mount a persistent filesystem which ## has extended attributes, such as ## ext3, JFS, or XFS.
policy/modules/kernel/filesystem.te +1 -0
@@ -8,6 +8,7 @@ policy_module(filesystem, 1.18.0) attribute filesystem_type; attribute filesystem_unconfined_type; attribute noxattrfs; +attribute xattrfs; ############################## #
Signature · 1 line
1.9.1
PATCH v2 2/3 Associate the new xattrfs attribute to fs_t and some pseudo-fs
From: Laurent Bigonville <[email protected]>
Associate the new xattrfs attribute to fs_t and the pseudo filesystems that we know support xattr
This patch adds the attribute to the following pseudo filesystems
- device_t
- devpts_t
- hugetlbfs
- sysfs_t
- tmpfs_t
--- policy/modules/kernel/devices.te | 4 ++-- policy/modules/kernel/filesystem.te | 5 +++-- policy/modules/kernel/terminal.te | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-)
policy/modules/kernel/devices.te +2 -2
@@ -18,7 +18,7 @@ fs_associate_tmpfs(device_t) files_type(device_t) files_mountpoint(device_t) files_associate_tmp(device_t) -fs_type(device_t) +fs_xattr_type(device_t) fs_use_trans devtmpfs gen_context(system_u:object_r:device_t,s0); #
@@ -224,7 +224,7 @@ dev_node(sound_device_t) # type sysfs_t; files_mountpoint(sysfs_t) -fs_type(sysfs_t) +fs_xattr_type(sysfs_t) genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0) #
policy/modules/kernel/filesystem.te +3 -2
@@ -17,6 +17,7 @@ attribute xattrfs; # type fs_t; fs_type(fs_t) +typeattribute fs_t xattrfs; sid fs gen_context(system_u:object_r:fs_t,s0) # Use xattrs for the following filesystem types.
@@ -95,7 +96,7 @@ fs_type(futexfs_t) genfscon futexfs / gen_context(system_u:object_r:futexfs_t,s0) type hugetlbfs_t; -fs_type(hugetlbfs_t) +fs_xattr_type(hugetlbfs_t) files_mountpoint(hugetlbfs_t) fs_use_trans hugetlbfs gen_context(system_u:object_r:hugetlbfs_t,s0);
@@ -175,7 +176,7 @@ genfscon vxfs / gen_context(system_u:object_r:vxfs_t,s0) # type tmpfs_t; dev_associate(tmpfs_t) -fs_type(tmpfs_t) +fs_xattr_type(tmpfs_t) files_type(tmpfs_t) files_mountpoint(tmpfs_t) files_poly_parent(tmpfs_t)
policy/modules/kernel/terminal.te +1 -1
@@ -27,7 +27,7 @@ dev_node(console_device_t) type devpts_t; files_mountpoint(devpts_t) fs_associate_tmpfs(devpts_t) -fs_type(devpts_t) +fs_xattr_type(devpts_t) fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0); #
Signature · 1 line
1.9.1
PATCH v2 2/3 Associate the new xattrfs attribute to fs_t and some pseudo-fs
Le Sat, 22 Mar 2014 13:06:10 +0100,
Laurent Bigonville <[email protected]> a ?crit :
[...]
policy/modules/kernel/filesystem.te attribute xattrfs; · line 23
Quoted 11 lines
b/policy/modules/kernel/filesystem.te index 4207e8f..a8a54d2 100644
policy/modules/kernel/filesystem.te +1
-0@@ -17,6 +17,7 @@ attribute xattrfs; # type fs_t; fs_type(fs_t) +typeattribute fs_t xattrfs; sid fs gen_context(system_u:object_r:fs_t,s0) # Use xattrs for the following filesystem types.
This should probably be changed to use the new fs_xattr_type() of course, or set the attribute directly as it's local.
[...]
I can post a v3 of the patch if you want
PATCH v2 2/3 Associate the new xattrfs attribute to fs_t and some pseudo-fs
Quoted 14 lines · Laurent Bigonville
Le Sat, 22 Mar 2014 13:06:10 +0100,
Laurent Bigonville <[email protected]> a ?crit :[...]
Quoted 10 lines
b/policy/modules/kernel/filesystem.te index 4207e8f..a8a54d2 100644
policy/modules/kernel/filesystem.te +1
-0@@ -17,6 +17,7 @@ attribute xattrfs; # type fs_t; fs_type(fs_t) +typeattribute fs_t xattrfs; sid fs gen_context(system_u:object_r:fs_t,s0)
Quoted 8 lines
policy/modules/kernel/filesystem.te attribute xattrfs; · line 23
Quoted 1 line
policy/modules/kernel/filesystem.te +0
-0# Use xattrs for the following filesystem types.This should probably be changed to use the new
fs_xattr_type()of course, or set the attribute directly as it's local.[...]
I can post a v3 of the patch if you want
I'd prefer to keep consistent and use a fs_xattr_type() call.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH v2 3/3 Use new fs_getattr_all_xattr_fs interface for setfiles_t and restorecond_t
In reply to Laurent BigonvilleFrom: Laurent Bigonville <[email protected]>
Use the new fs_getattr_all_xattr_fs() interface to allow setfiles_t and restorecond_t domain to also get the attributes on pseudo-filesystems that support xattr
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740682
--- policy/modules/system/selinuxutil.te | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
policy/modules/system/selinuxutil.te +2 -2
@@ -330,7 +330,7 @@ kernel_read_system_state(restorecond_t) fs_relabelfrom_noxattr_fs(restorecond_t) fs_dontaudit_list_nfs(restorecond_t) -fs_getattr_xattr_fs(restorecond_t) +fs_getattr_all_xattr_fs(restorecond_t) fs_list_inotifyfs(restorecond_t) selinux_validate_context(restorecond_t)
@@ -558,7 +558,7 @@ files_relabel_all_files(setfiles_t) files_read_usr_symlinks(setfiles_t) files_dontaudit_read_all_symlinks(setfiles_t) -fs_getattr_xattr_fs(setfiles_t) +fs_getattr_all_xattr_fs(setfiles_t) fs_list_all(setfiles_t) fs_search_auto_mountpoints(setfiles_t) fs_relabelfrom_noxattr_fs(setfiles_t)
Signature · 1 line
1.9.1