Skip to contentSkip to conversation

Declare a virtio device node type

PATCH New Dominick Grift 2 participants 2 messages Sep 12, 2012 – Oct 3, 2012

lore
Share & tools
lore

Dominick Grift

author
#0 lore raw

PATCH 1/1 Declare a virtio device node type

Label virtio character device nodes accordingly

Create term_use_virtio_console() for vdagent

Signed-off-by Dominick Grift <[email protected]>
policy/modules/kernel/terminal.fc +1 -0
index 7d45d15..0ea25b6 100644
@@ -19,6 +19,7 @@
 /dev/slamr[0-9]+	-c	gen_context(system_u:object_r:tty_device_t,s0)
 /dev/tty		-c	gen_context(system_u:object_r:devtty_t,s0)
 /dev/ttySG.*		-c	gen_context(system_u:object_r:tty_device_t,s0)
+/dev/vport[0-9]p[0-9]+	-c	gen_context(system_u:object_r:virtio_device_t,s0)
 /dev/xvc[^/]*		-c	gen_context(system_u:object_r:tty_device_t,s0)
 
 /dev/pty/.*		-c	gen_context(system_u:object_r:bsdpty_device_t,s0)
policy/modules/kernel/terminal.if +19 -0
index 01dd2f1..bfaff9f 100644
@@ -1493,3 +1493,22 @@
 	refpolicywarn(`$0() is deprecated, use term_dontaudit_use_all_ttys() instead.')
 	term_dontaudit_use_all_ttys($1)
 ')
+
+########################################
+## <summary>
+##	Read from and write to virtio console.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`term_use_virtio_console',`
+	gen_require(`
+		type virtio_device_t;
+	')
+
+	dev_list_all_dev_nodes($1)
+	allow $1 virtio_device_t:chr_file rw_chr_file_perms;
+')
policy/modules/kernel/terminal.te +3 -0
index 9d64659..bc57297 100644
@@ -56,3 +56,6 @@
 #
 type usbtty_device_t, serial_device;
 dev_node(usbtty_device_t)
+
+type virtio_device_t, serial_device;
+dev_node(virtio_device_t)
#1 lore raw

PATCH 1/1 Declare a virtio device node type

Quoted 35 lines · Dominick Grift

Label virtio character device nodes accordingly

Create term_use_virtio_console() for vdagent

Signed-off-by Dominick Grift <[email protected]>
policy/modules/kernel/terminal.fc +1 -0
index 7d45d15..0ea25b6 100644
@@ -19,6 +19,7 @@
 /dev/slamr[0-9]+	-c	gen_context(system_u:object_r:tty_device_t,s0)
 /dev/tty		-c	gen_context(system_u:object_r:devtty_t,s0)
 /dev/ttySG.*		-c	gen_context(system_u:object_r:tty_device_t,s0)
+/dev/vport[0-9]p[0-9]+	-c	gen_context(system_u:object_r:virtio_device_t,s0)
 /dev/xvc[^/]*		-c	gen_context(system_u:object_r:tty_device_t,s0)
 
 /dev/pty/.*		-c	gen_context(system_u:object_r:bsdpty_device_t,s0)
policy/modules/kernel/terminal.if +9 -0
index 01dd2f1..bfaff9f 100644
@@ -1493,3 +1493,22 @@
 	refpolicywarn(`$0() is deprecated, use term_dontaudit_use_all_ttys() instead.')
 	term_dontaudit_use_all_ttys($1)
 ')
+
+########################################
+## <summary>
+##	Read from and write to virtio console.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>

policy/modules/kernel/terminal.if line 1514

Quoted 10 lines
policy/modules/kernel/terminal.if +10 -0
+## </param>
+#
+interface(`term_use_virtio_console',`
+	gen_require(`
+		type virtio_device_t;
+	')
+
+	dev_list_all_dev_nodes($1)
+	allow $1 virtio_device_t:chr_file rw_chr_file_perms;
+')

Is this really only a console/serial device? The bits that I can find seem to imply its more than just a console, but I'm not sure.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com