soundserver policy modification
RFC PATCH 1/1 soundserver policy modification
hi all,
i add some policy for nas(network audio system), the drive of this modification is:
http://marc.info/?l=fedora-selinux-list&m=118493958413746&w=2
i post the modification to fedora-selinux-list at last Saturday. Considering that fedora rawhide policy now is merged version(strict and targeted), which is somewhat different from the upstream policy, so i post to that list:
http://marc.info/?l=fedora-selinux-list&m=118561164825982&w=2
but there wasnt reply about this patch until now, so i think i post to the wrong place, then i "diff" with the upstream policy(2377).
please review this patch.
thanks in advance.
policy/modules/services/soundserver.fc +23 -5
@@ -1,10 +1,28 @@ -/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) /etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) - -/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0) /usr/bin/gpe-soundserver -- gen_context(system_u:object_r:soundd_exec_t,s0) - /usr/sbin/yiff -- gen_context(system_u:object_r:soundd_exec_t,s0) - /var/run/yiff-[0-9]+\.pid -- gen_context(system_u:object_r:soundd_var_run_t,s0) /var/state/yiff(/.*)? gen_context(system_u:object_r:soundd_state_t,s0) + + +# +# Following is for nas + +# +# /usr/bin +# + +/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0) + + +# +# /tmp +# +/tmp/\.sockets -d gen_context(system_u:object_r:soundd_tmp_t,s0) +/tmp/\.sockets/.* -s <<none>> + +# +# /etc +# +/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) +
policy/modules/services/soundserver.if +61 -0
64 lines not on this page · raw message
policy/modules/services/soundserver.te +25 -9
@@ -1,5 +1,5 @@ -policy_module(soundserver,1.3.0) +policy_module(soundserver,1.3.1) ######################################## #
@@ -8,10 +8,13 @@ type soundd_t; type soundd_exec_t; +domain_type(soundd_t) +domain_entry_file(soundd_t,soundd_exec_t) init_daemon_domain(soundd_t,soundd_exec_t) type soundd_etc_t alias etc_soundd_t; -files_type(soundd_etc_t) +#files_type(soundd_etc_t) +files_config_file(soundd_etc_t) type soundd_state_t; files_type(soundd_state_t)
@@ -28,13 +31,32 @@ ######################################## # -# Declarations +# sound server local policy # dontaudit soundd_t self:capability sys_tty_config; allow soundd_t self:process { setpgid signal_perms }; + allow soundd_t self:tcp_socket create_stream_socket_perms; allow soundd_t self:udp_socket create_socket_perms; + +allow soundd_t self:unix_stream_socket { connectto create_stream_socket_perms }; +manage_sock_files_pattern(soundd_t,soundd_tmp_t,soundd_tmp_t) +files_tmp_filetrans(soundd_t, soundd_tmp_t, { file dir sock_file }) + + +# Remove /tmp/.sockets/audio$n +delete_files_pattern(soundd_t,soundd_tmp_t,soundd_tmp_t) +delete_sock_files_pattern(soundd_t,soundd_tmp_t,soundd_tmp_t) + +allow soundd_t self:capability { dac_override }; + +fs_getattr_all_fs(soundd_t) + +optional_policy(` + alsa_domtrans(soundd_t) +') + # for yiff allow soundd_t self:shm create_shm_perms;
@@ -98,12 +120,6 @@ userdom_dontaudit_use_unpriv_user_fds(soundd_t) userdom_dontaudit_search_sysadm_home_dirs(soundd_t) -ifdef(`targeted_policy',` - term_dontaudit_use_unallocated_ttys(soundd_t) - term_dontaudit_use_generic_ptys(soundd_t) - files_dontaudit_read_root_files(soundd_t) -') - optional_policy(` seutil_sigchld_newrole(soundd_t) ')
Quoted 13 lines · Ken YANG
hi all,
i add some policy for nas(network audio system), the drive of this modification is:
http://marc.info/?l=fedora-selinux-list&m=118493958413746&w=2
i post the modification to fedora-selinux-list at last Saturday. Considering that fedora rawhide policy now is merged version(strict and targeted), which is somewhat different from the upstream policy, so i post to that list:
Quoted 7 lines
http://marc.info/?l=fedora-selinux-list&m=118561164825982&w=2
but there wasnt reply about this patch until now, so i think i post to the wrong place, then i "diff" with the upstream policy(2377).
please review this patch.
sorry, in last patch, i forgot add some targeted_policy rules, which had been removed from the merged-version policy(selinux-policy>3.0)
additionally, the new patch based on 2383 version
Quoted 6 lines
thanks in advance.
policy/modules/services/soundserver.fc +23 -5
@@ -1,10 +1,28 @@ -/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) /etc/yiff(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) - -/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0) /usr/bin/gpe-soundserver -- gen_context(system_u:object_r:soundd_exec_t,s0) - /usr/sbin/yiff -- gen_context(system_u:object_r:soundd_exec_t,s0) - /var/run/yiff-[0-9]+\.pid -- gen_context(system_u:object_r:soundd_var_run_t,s0) /var/state/yiff(/.*)? gen_context(system_u:object_r:soundd_state_t,s0) + + +# +# Following is for nas + +# +# /usr/bin +# + +/usr/bin/nasd -- gen_context(system_u:object_r:soundd_exec_t,s0) + + +# +# /tmp +# +/tmp/\.sockets -d gen_context(system_u:object_r:soundd_tmp_t,s0) +/tmp/\.sockets/.* -s <<none>> + +# +# /etc +# +/etc/nas(/.*)? gen_context(system_u:object_r:soundd_etc_t,s0) +
policy/modules/services/soundserver.if +61 -0
64 lines not on this page · raw message
policy/modules/services/soundserver.te +25 -3
@@ -1,5 +1,5 @@ -policy_module(soundserver,1.3.0) +policy_module(soundserver,1.3.1) ######################################## #
@@ -8,10 +8,13 @@ type soundd_t; type soundd_exec_t; +domain_type(soundd_t) +domain_entry_file(soundd_t,soundd_exec_t) init_daemon_domain(soundd_t,soundd_exec_t) type soundd_etc_t alias etc_soundd_t; -files_type(soundd_etc_t) +#files_type(soundd_etc_t) +files_config_file(soundd_etc_t) type soundd_state_t; files_type(soundd_state_t)
@@ -28,13 +31,32 @@ ######################################## # -# Declarations +# sound server local policy # dontaudit soundd_t self:capability sys_tty_config; allow soundd_t self:process { setpgid signal_perms }; + allow soundd_t self:tcp_socket create_stream_socket_perms; allow soundd_t self:udp_socket create_socket_perms; + +allow soundd_t self:unix_stream_socket { connectto create_stream_socket_perms }; +manage_sock_files_pattern(soundd_t,soundd_tmp_t,soundd_tmp_t) +files_tmp_filetrans(soundd_t, soundd_tmp_t, { file dir sock_file }) + + +# Remove /tmp/.sockets/audio$n +delete_files_pattern(soundd_t,soundd_tmp_t,soundd_tmp_t) +delete_sock_files_pattern(soundd_t,soundd_tmp_t,soundd_tmp_t) + +allow soundd_t self:capability { dac_override }; + +fs_getattr_all_fs(soundd_t) + +optional_policy(` + alsa_domtrans(soundd_t) +') + # for yiff allow soundd_t self:shm create_shm_perms;