Marking as mountpoints
cover Marking as mountpoints
Some file system types (like debugfs_t) are also to be marked as mountpoints as the associated file system is mounted on the directory that is labeled that way.
Separate patches because of contrib vs non-contrib.
Wkr,
Sven Vermeulen
PATCH 1/2 Many users use a separate mount for /usr/portage
The /usr/portage location in the Gentoo distribution is often used as a separate mount.
--- portage.te | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
portage.te +1 -1
@@ -47,7 +47,7 @@ type portage_devpts_t; term_pty(portage_devpts_t) type portage_ebuild_t; -files_type(portage_ebuild_t) +files_mountpoint(portage_ebuild_t) type portage_fetch_tmp_t; files_tmp_file(portage_fetch_tmp_t)
Signature · 1 line
1.7.3.4
PATCH 1/2 Many users use a separate mount for /usr/portage
Quoted 13 lines · Sven Vermeulen
The
/usr/portagelocation in the Gentoo distribution is often used as a separate mount.Signed-off-by Sven Vermeulen <[email protected]>--- portage.te | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)portage.te +0
-0
portage.te type portage_devpts_t; · line 53
Quoted 8 lines
portage.te +1
-1@@ -47,7 +47,7 @@ type portage_devpts_t; term_pty(portage_devpts_t) type portage_ebuild_t; -files_type(portage_ebuild_t) +files_mountpoint(portage_ebuild_t) type portage_fetch_tmp_t; files_tmp_file(portage_fetch_tmp_t)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Marking debugfs and securityfs as mountpoints
In reply to Sven VermeulenThe locations for debugfs_t (/sys/kernel/debug) and security_t (/selinux or /sys/fs/selinux) should be marked as mountpoints as well.
--- policy/modules/kernel/kernel.te | 1 + policy/modules/kernel/selinux.te | 1 + 2 files changed, 2 insertions(+), 0 deletions(-)
policy/modules/kernel/kernel.te +1 -0
@@ -56,6 +56,7 @@ sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh) # type debugfs_t; +files_mountpoint(debugfs_t) fs_type(debugfs_t) allow debugfs_t self:filesystem associate; genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)
policy/modules/kernel/selinux.te +1 -0
@@ -29,6 +29,7 @@ selinux_labeled_boolean(secure_mode_policyload_t, secure_mode_policyload) # applied to selinuxfs inodes. # type security_t, boolean_type; +files_mountpoint(security_t) fs_type(security_t) mls_trusted_object(security_t) sid security gen_context(system_u:object_r:security_t,mls_systemhigh)
Signature · 1 line
1.7.3.4
PATCH 1/1 Marking debugfs and securityfs as mountpoints
Quoted 26 lines · Sven Vermeulen
The locations for
debugfs_t(/sys/kernel/debug) andsecurity_t(/selinux or/sys/fs/selinux) should be marked as mountpoints as well.Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/kernel/kernel.te | 1 + policy/modules/kernel/selinux.te | 1 + 2 files changed, 2 insertions(+), 0 deletions(-)policy/modules/kernel/kernel.te +1
-0@@ -56,6 +56,7 @@ sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh) # type debugfs_t; +files_mountpoint(debugfs_t) fs_type(debugfs_t) allow debugfs_t self:filesystem associate; genfscon debugfs / gen_context(system_u:object_r:debugfs_t,s0)policy/modules/kernel/selinux.te +0
-0
policy/modules/kernel/selinux.te selinux_labeled_boolean(secure_mode_policyload_t, secure_mode_policyload) · line 35
Quoted 7 lines
policy/modules/kernel/selinux.te +1
-0@@ -29,6 +29,7 @@ selinux_labeled_boolean(secure_mode_policyload_t, secure_mode_policyload) # applied to selinuxfs inodes. # type security_t, boolean_type; +files_mountpoint(security_t) fs_type(security_t) mls_trusted_object(security_t) sid security gen_context(system_u:object_r:security_t,mls_systemhigh)
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com