label some character device nodes

PATCH New Dominick Grift 3 participants 9 messages Aug 31, 2012 – Sep 5, 2012

Share & tools

Dominick Grift

author

2012-08-31 17:38 UTC #0 lore raw

cover label some character device nodes

I am currently trying to get refpolicy to work in a nobase text kvm-guest, to see if i can come up with a better policy for systemd.

In the process is stumbled upon some unlabeled character device nodes.

Dominick Grift (2):
Declare a loop control device node type and label /dev/loop-control
accordingly
Declare a virtio port device type and label /dev/vport.* accordingly

 policy/modules/kernel/devices.fc | 2 ++
 policy/modules/kernel/devices.te | 6 ++++++
 2 files changed, 8 insertions(+)

Signature · 1 line

1.7.11.4

Dominick Grift

author

2012-08-31 17:38 UTC #1 lore raw

PATCH 1/2 Declare a loop control device node type and label /dev/loop-control accordingly

Signed-off-by Dominick Grift <[email protected]>

---
 policy/modules/kernel/devices.fc | 1 +
 policy/modules/kernel/devices.te | 3 +++
 2 files changed, 4 insertions(+)

policy/modules/kernel/devices.fc +1 -0

index 84e7337..5214c08 100644
@@ -57,6 +57,7 @@
 /dev/lirc[0-9]+		-c	gen_context(system_u:object_r:lirc_device_t,s0)
 /dev/lircm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/logibm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
+/dev/loop-control	-c	gen_context(system_u:object_r:loop_control_device_t,s0)
 /dev/lp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
 /dev/mcelog		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
 /dev/mei		-c	gen_context(system_u:object_r:mei_device_t,s0)

policy/modules/kernel/devices.te +3 -0

index 17e0915..99fe460 100644
@@ -115,6 +115,9 @@ dev_node(kvm_device_t)
 type lirc_device_t;
 dev_node(lirc_device_t)
 
+type loop_control_device_t;
+dev_node(loop_control_device_t)
+
 #
 # Type for /dev/mapper/control
 #

Signature · 1 line

1.7.11.4

Christopher J. PeBenito

2012-09-05 17:45 UTC #2 lore raw

PATCH 1/2 Declare a loop control device node type and label /dev/loop-control accordingly

Quoted 24 lines · Dominick Grift

Signed-off-by Dominick Grift <[email protected]>

---
 policy/modules/kernel/devices.fc | 1 +
 policy/modules/kernel/devices.te | 3 +++
 2 files changed, 4 insertions(+)

policy/modules/kernel/devices.fc +1 -0

index 84e7337..5214c08 100644
@@ -57,6 +57,7 @@
 /dev/lirc[0-9]+		-c	gen_context(system_u:object_r:lirc_device_t,s0)
 /dev/lircm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/logibm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
+/dev/loop-control	-c	gen_context(system_u:object_r:loop_control_device_t,s0)
 /dev/lp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
 /dev/mcelog		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
 /dev/mei		-c	gen_context(system_u:object_r:mei_device_t,s0)

policy/modules/kernel/devices.te +0 -0

index 17e0915..99fe460 100644

policy/modules/kernel/devices.te dev_node(kvm_device_t) · line 123

Quoted 9 lines

policy/modules/kernel/devices.te +3 -0

@@ -115,6 +115,9 @@ dev_node(kvm_device_t)
 type lirc_device_t;
 dev_node(lirc_device_t)
 
+type loop_control_device_t;
+dev_node(loop_control_device_t)
+
 #
 # Type for /dev/mapper/control
 #

Merged.

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

Dominick Grift

author

2012-08-31 17:38 UTC #3 lore raw

PATCH 2/2 Declare a virtio port device type and label /dev/vport.* accordingly

In reply to Dominick Grift

Signed-off-by Dominick Grift <[email protected]>

---
 policy/modules/kernel/devices.fc | 1 +
 policy/modules/kernel/devices.te | 3 +++
 2 files changed, 4 insertions(+)

policy/modules/kernel/devices.fc +1 -0

index 5214c08..94505c4 100644
@@ -124,6 +124,7 @@ ifdef(`distro_suse', `
 /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
 /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
 /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
+/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
 /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
 /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)

policy/modules/kernel/devices.te +3 -0

index 99fe460..52c535d 100644
@@ -272,6 +272,9 @@ dev_node(v4l_device_t)
 type vhost_device_t;
 dev_node(vhost_device_t)
 
+type virtio_device_t;
+dev_node(virtio_device_t)
+
 # Type for vmware devices.
 type vmware_device_t;
 dev_node(vmware_device_t)

Signature · 1 line

1.7.11.4

Miroslav Grepl

2012-09-04 10:28 UTC #4 lore raw

PATCH 2/2 Declare a virtio port device type and label /dev/vport.* accordingly

Quoted 23 lines · Dominick Grift

Signed-off-by Dominick Grift <[email protected]>

---
  policy/modules/kernel/devices.fc | 1 +
  policy/modules/kernel/devices.te | 3 +++
  2 files changed, 4 insertions(+)

policy/modules/kernel/devices.fc +1 -0

index 5214c08..94505c4 100644
@@ -124,6 +124,7 @@ ifdef(`distro_suse', `
  /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
  /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
  /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
+/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
  /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
  /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
  /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)

policy/modules/kernel/devices.te +0 -0

index 99fe460..52c535d 100644

policy/modules/kernel/devices.te dev_node(v4l_device_t) · line 280

Quoted 9 lines

policy/modules/kernel/devices.te +3 -0

@@ -272,6 +272,9 @@ dev_node(v4l_device_t)
  type vhost_device_t;
  dev_node(vhost_device_t)
 
+type virtio_device_t;
+dev_node(virtio_device_t)
+
  # Type for vmware devices.
  type vmware_device_t;
  dev_node(vmware_device_t)

We declare it in terminal.* policy files.

Also I think base access interfaces should be part of this patch?

Dominick Grift

author

2012-09-04 12:50 UTC #5 lore raw

PATCH 2/2 Declare a virtio port device type and label /dev/vport.* accordingly

Quoted 27 lines · Miroslav Grepl

Quoted 26 lines · Dominick Grift

Signed-off-by Dominick Grift <[email protected]>

---
  policy/modules/kernel/devices.fc | 1 +
  policy/modules/kernel/devices.te | 3 +++
  2 files changed, 4 insertions(+)

policy/modules/kernel/devices.fc +1 -0

index 5214c08..94505c4 100644
@@ -124,6 +124,7 @@ ifdef(`distro_suse', `
  /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
  /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
  /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
+/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
  /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
  /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
  /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)

policy/modules/kernel/devices.te +0 -0

index 99fe460..52c535d 100644
@@ -272,6 +272,9 @@ dev_node(v4l_device_t)
  type vhost_device_t;
  dev_node(vhost_device_t)

Quoted 7 lines

policy/modules/kernel/devices.te dev_node(v4l_device_t) · line 280
Quoted 6 lines
policy/modules/kernel/devices.te +3 -0
+type virtio_device_t;
+dev_node(virtio_device_t)
+
  # Type for vmware devices.
  type vmware_device_t;
  dev_node(vmware_device_t)
We declare it in terminal.* policy files.

must be new then, last time i tried (a week ago on f18?) it was still mislabeled (device_t)

Quoted 1 line

Also I think base access interfaces should be part of this patch?

i don't see that requirement. i also haven't encountered any process trying to access it yet.

Miroslav Grepl

2012-09-04 18:31 UTC #6 lore raw

PATCH 2/2 Declare a virtio port device type and label /dev/vport.* accordingly

Quoted 36 lines · Dominick Grift

Quoted 27 lines · Miroslav Grepl

Quoted 26 lines · Dominick Grift

Signed-off-by Dominick Grift <[email protected]>

---
   policy/modules/kernel/devices.fc | 1 +
   policy/modules/kernel/devices.te | 3 +++
   2 files changed, 4 insertions(+)

policy/modules/kernel/devices.fc +1 -0

index 5214c08..94505c4 100644
@@ -124,6 +124,7 @@ ifdef(`distro_suse', `
   /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
   /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
   /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
+/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
   /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
   /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
   /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)

policy/modules/kernel/devices.te +0 -0

index 99fe460..52c535d 100644
@@ -272,6 +272,9 @@ dev_node(v4l_device_t)
   type vhost_device_t;
   dev_node(vhost_device_t)

Quoted 7 lines

policy/modules/kernel/devices.te dev_node(v4l_device_t) · line 280
Quoted 6 lines
policy/modules/kernel/devices.te +3 -0
+type virtio_device_t;
+dev_node(virtio_device_t)
+
   # Type for vmware devices.
   type vmware_device_t;
   dev_node(vmware_device_t)
We declare it in terminal.* policy files.

Quoted 2 lines

must be new then, last time i tried (a week ago on f18?) it was still mislabeled (device_t)

We have

/dev/vport[0-9]p[0-9]+ -c gen_context(system_u:object_r:virtio_device_t,s0)

maybe it needs to be fixed.

And then

rhev.te:term_use_virtio_console(rhev_agentd_t)
rhev.te: term_use_virtio_console(rhev_agentd_consolehelper_t)
vdagent.te:term_use_virtio_console(vdagent_t)

Quoted 5 lines

Quoted 2 lines
Also I think base access interfaces should be part of this patch?
i don't see that requirement. i also haven't encountered any process trying to access it yet.

Dominick Grift

author

2012-09-04 19:08 UTC #7 lore raw

PATCH 2/2 Declare a virtio port device type and label /dev/vport.* accordingly

Quoted 10 lines · Miroslav Grepl

/dev/vport[0-9]p[0-9]+ -c gen_context(system_u:object_r:virtio_device_t,s0)
maybe it needs to be fixed.
And then
rhev.te:term_use_virtio_console(rhev_agentd_t)
rhev.te: term_use_virtio_console(rhev_agentd_consolehelper_t)
vdagent.te:term_use_virtio_console(vdagent_t)

could you please create a patch for refpolicy that fixes this issue? I would do it but i screwed up my refpolicy repository and cant undo it right now because i am in the middle of a project.

But if you do , please double check the file context spec becuase i suspect that it may not catch the interface. (i submitted this patch because the device was mislabeled)

Quoted 6 lines

Quoted 5 lines
Quoted 2 lines
Also I think base access interfaces should be part of this patch?
i don't see that requirement. i also haven't encountered any process trying to access it yet.

Dominick Grift

author

2012-09-04 19:23 UTC #8 lore raw

PATCH 2/2 Declare a virtio port device type and label /dev/vport.* accordingly

In reply to Miroslav Grepl

Quoted 43 lines · Miroslav Grepl

Quoted 36 lines · Dominick Grift
Quoted 27 lines · Miroslav Grepl
Quoted 26 lines · Dominick Grift
Signed-off-by Dominick Grift <[email protected]>
---
   policy/modules/kernel/devices.fc | 1 +
   policy/modules/kernel/devices.te | 3 +++
   2 files changed, 4 insertions(+)
policy/modules/kernel/devices.fc +1 -0
index 5214c08..94505c4 100644
@@ -124,6 +124,7 @@ ifdef(`distro_suse', `
   /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
   /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
   /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
+/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
   /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
   /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
   /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
policy/modules/kernel/devices.te +0 -0
index 99fe460..52c535d 100644
@@ -272,6 +272,9 @@ dev_node(v4l_device_t)
   type vhost_device_t;
   dev_node(vhost_device_t)
 
Quoted 7 lines
policy/modules/kernel/devices.te dev_node(v4l_device_t) · line 280
Quoted 6 lines
policy/modules/kernel/devices.te +3 -0
+type virtio_device_t;
+dev_node(virtio_device_t)
+
   # Type for vmware devices.
   type vmware_device_t;
   dev_node(vmware_device_t)
We declare it in terminal.* policy files.
Quoted 2 lines
must be new then, last time i tried (a week ago on f18?) it was still mislabeled (device_t)
We have
/dev/vport[0-9]p[0-9]+ -c gen_context(system_u:object_r:virtio_device_t,s0)

Quoted 14 lines

maybe it needs to be fixed.
And then
rhev.te:term_use_virtio_console(rhev_agentd_t)
rhev.te: term_use_virtio_console(rhev_agentd_consolehelper_t)
vdagent.te:term_use_virtio_console(vdagent_t)
Quoted 5 lines
Quoted 2 lines
Also I think base access interfaces should be part of this patch?
i don't see that requirement. i also haven't encountered any process trying to access it yet.

never mind, this patch was not merged.

so just ignore this patch