Allow cgred to setsched all allow initrc (/usr/bin/cgclear) setsched all allow cgred sys_admin capability
PATCH 1/1 Allow cgred to setsched all allow initrc (/usr/bin/cgclear) setsched all allow cgred sys_admin capability
Allow cgred to setsched all
Allow initrc (/usr/bin/cgclear) setsched all
Allow cgred sys_admin capability
---
:100644 100644 bb3a671... 6ae88ca... M policy/modules/services/cgroup.te
:100644 100644 d9d2789... 5926603... M policy/modules/system/init.te
policy/modules/services/cgroup.te | 3 ++- policy/modules/system/init.te | 1 + 2 files changed, 3 insertions(+), 1 deletions(-)
policy/modules/services/cgroup.te +2 -1
@@ -53,7 +53,7 @@ fs_unmount_cgroup(cgconfig_t) # cgred personal policy. # -allow cgred_t self:capability { net_admin sys_ptrace dac_override }; +allow cgred_t self:capability { net_admin sys_admin sys_ptrace dac_override }; allow cgred_t self:netlink_socket { write bind create read }; allow cgred_t self:unix_dgram_socket { write create connect };
@@ -65,6 +65,7 @@ files_pid_filetrans(cgred_t, cgred_var_run_t, sock_file) kernel_read_system_state(cgred_t) domain_read_all_domains_state(cgred_t) +domain_setpriority_all_domains(cgred_t) files_getattr_all_files(cgred_t) files_getattr_all_sockets(cgred_t)
policy/modules/system/init.te +1 -0
@@ -575,6 +575,7 @@ optional_policy(` optional_policy(` cgroup_stream_connect(initrc_t) + domain_setpriority_all_domains(initrc_t) ') optional_policy(`
Signature · 9 lines
1.7.1 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100705/772a0623/attachment.bin
PATCH 1/1 Allow cgred to setsched all allow initrc (/usr/bin/cgclear) setsched all allow cgred sys_admin capability
Quoted 3 lines · Dominick Grift
Allow cgred to setsched all
Allow initrc (/usr/bin/cgclear) setsched all
Allow cgredsys_admincapability
Based on what I see from the cgclear man page, it seems like it should be running in the cgconfig_t domain.
Quoted 48 lines
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 bb3a671... 6ae88ca... M policy/modules/services/cgroup.te
:100644 100644 d9d2789... 5926603... M policy/modules/system/init.tepolicy/modules/services/cgroup.te | 3 ++- policy/modules/system/init.te | 1 + 2 files changed, 3 insertions(+), 1 deletions(-)policy/modules/services/cgroup.te +2
-1@@ -53,7 +53,7 @@ fs_unmount_cgroup(cgconfig_t) # cgred personal policy. # -allow cgred_t self:capability { net_admin sys_ptrace dac_override }; +allow cgred_t self:capability { net_admin sys_admin sys_ptrace dac_override }; allow cgred_t self:netlink_socket { write bind create read }; allow cgred_t self:unix_dgram_socket { write create connect };@@ -65,6 +65,7 @@ files_pid_filetrans(cgred_t, cgred_var_run_t, sock_file) kernel_read_system_state(cgred_t) domain_read_all_domains_state(cgred_t) +domain_setpriority_all_domains(cgred_t) files_getattr_all_files(cgred_t) files_getattr_all_sockets(cgred_t)policy/modules/system/init.te +1
-0@@ -575,6 +575,7 @@ optional_policy(` optional_policy(` cgroup_stream_connect(initrc_t) + domain_setpriority_all_domains(initrc_t) ') optional_policy(`_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Allow cgred to setsched all allow initrc (/usr/bin/cgclear) setsched all allow cgred sys_admin capability
Quoted 7 lines · Christopher J. PeBenito
Quoted 3 lines · Dominick Grift
Allow cgred to setsched all
Allow initrc (/usr/bin/cgclear) setsched all
Allow cgredsys_admincapabilityBased on what I see from the cgclear man page, it seems like it should be running in the
cgconfig_tdomain.
In recent times i have confined /usr/bin/cgclear but i later decided to undo it (it is probably in my "git log" though).
cgclear isnt such a problem to run confined but this app can also be run by users.
A similar app is cgexec this program basically "extends" init script, but it can also be used to users.
Confining both cgclear and cgexec is possible but it make thing probably more complicated then they need to be.
There are other cg apps called from cgconfig init script as well like: cgset, cgclassify, cgcreate. These are really /usr/bin user apps.
Looking at the initrc policy, initrc has pretty much access so i personally do not have a problem adding this as well to avoid unneeded complications.
Quoted 41 lines
Quoted 41 lines
Signed-off-by Dominick Grift<[email protected]>---
:100644 100644 bb3a671... 6ae88ca... M policy/modules/services/cgroup.te
:100644 100644 d9d2789... 5926603... M policy/modules/system/init.tepolicy/modules/services/cgroup.te | 3 ++- policy/modules/system/init.te | 1 + 2 files changed, 3 insertions(+), 1 deletions(-)policy/modules/services/cgroup.te +2
-1@@ -53,7 +53,7 @@ fs_unmount_cgroup(cgconfig_t) # cgred personal policy. # -allow cgred_t self:capability { net_admin sys_ptrace dac_override }; +allow cgred_t self:capability { net_admin sys_admin sys_ptrace dac_override }; allow cgred_t self:netlink_socket { write bind create read }; allow cgred_t self:unix_dgram_socket { write create connect };@@ -65,6 +65,7 @@ files_pid_filetrans(cgred_t, cgred_var_run_t, sock_file) kernel_read_system_state(cgred_t) domain_read_all_domains_state(cgred_t) +domain_setpriority_all_domains(cgred_t) files_getattr_all_files(cgred_t) files_getattr_all_sockets(cgred_t)policy/modules/system/init.te +1
-0@@ -575,6 +575,7 @@ optional_policy(` optional_policy(` cgroup_stream_connect(initrc_t) + domain_setpriority_all_domains(initrc_t) ')
Quoted 14 lines
Quoted 8 lines
policy/modules/system/init.te +0
-0optional_policy(`_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicySignature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100706/416e1b02/attachment.bin
PATCH 1/1 Allow cgred to setsched all allow initrc (/usr/bin/cgclear) setsched all allow cgred sys_admin capability
Quoted 6 lines · Dominick Grift
Quoted 5 lines · Christopher J. PeBenito
Quoted 3 lines · Dominick Grift
Allow cgred to setsched all
Allow initrc (/usr/bin/cgclear) setsched all
Allow cgredsys_admincapability
Quoted 6 lines
Quoted 2 lines
Based on what I see from the cgclear man page, it seems like it should be running in the
cgconfig_tdomain.In recent times i have confined
/usr/bin/cgclearbut i later decided to undo it (it is probably in my "git log" though).cgclear isnt such a problem to run confined but this app can also be run by users.
This seems like even more of a reason for it to run in cgconfig_t.
Quoted 1 line
A similar app is cgexec this program basically "extends" init script, but it can also be used to users.
But the purpose of cgconfig_t is for configuring cgroups, right? Clearing cgroups is a configuration action too.
Quoted 5 lines
Confining both cgclear and cgexec is possible but it make thing probably more complicated then they need to be.
There are other cg apps called from cgconfig init script as well like: cgset, cgclassify, cgcreate. These are really
/usr/binuser apps.Looking at the initrc policy, initrc has pretty much access so i personally do not have a problem adding this as well to avoid unneeded complications.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com