Skip to contentSkip to conversation

Support cachefiles

PATCH New Dominick Grift 3 participants 6 messages Sep 23, 2012 – Oct 4, 2012

lore
Share & tools
lore

Dominick Grift

author
#0 lore raw

cover Support cachefiles

These are needed by cachefilesd

Dominick Grift (2):
Declare a cachfiles device node type Implement files_create_all_files_as() for cachefilesd

 policy/modules/kernel/devices.fc |  1 +
 policy/modules/kernel/devices.if | 19 +++++++++++++++++++
 policy/modules/kernel/devices.te |  3 +++
 policy/modules/kernel/files.if   | 18 ++++++++++++++++++
 4 files changed, 41 insertions(+)
Signature · 1 line
1.7.11.4
author
#1 lore raw

PATCH 1/2 Declare a cachfiles device node type

Used by kernel to communicate with user space (cachefilesd) Label the character file accordingly

Create a dev_rw_cachefiles_dev() for cachefilesd

Signed-off-by Dominick Grift <[email protected]>
---
 policy/modules/kernel/devices.fc |  1 +
 policy/modules/kernel/devices.if | 19 +++++++++++++++++++
 policy/modules/kernel/devices.te |  3 +++
 3 files changed, 23 insertions(+)
policy/modules/kernel/devices.fc +1 -0
index 5214c08..ddbfa12 100644
@@ -17,6 +17,7 @@
 /dev/autofs.*		-c	gen_context(system_u:object_r:autofs_device_t,s0)
 /dev/beep		-c	gen_context(system_u:object_r:sound_device_t,s0)
 /dev/btrfs-control	-c	gen_context(system_u:object_r:lvm_control_t,s0)
+/dev/cachefiles	-c	gen_context(system_u:object_r:cachefiles_dev_t,s0)
 /dev/controlD64		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
 /dev/crash		-c	gen_context(system_u:object_r:crash_device_t,mls_systemhigh)
 /dev/dahdi/.*		-c	gen_context(system_u:object_r:sound_device_t,s0)
policy/modules/kernel/devices.if +19 -0
index d820975..7b585be 100644
@@ -1560,6 +1560,25 @@ interface(`dev_relabel_autofs_dev',`
 
 ########################################
 ## <summary>
+##	Read and write cachefiles character
+##	device nodes.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`dev_rw_cachefiles',`
+	gen_require(`
+		type device_t, cachefiles_dev_t;
+	')
+
+	rw_chr_files_pattern($1, device_t, cachefiles_dev_t)
+')
+
+########################################
+## <summary>
 ##	Read and write the PCMCIA card manager device.
 ## </summary>
 ## <param name="domain">
policy/modules/kernel/devices.te +3 -0
index 108b68b..52519e3 100644
@@ -43,6 +43,9 @@ type cardmgr_dev_t;
 dev_node(cardmgr_dev_t)
 files_tmp_file(cardmgr_dev_t)
 
+type cachefiles_dev_t;
+dev_node(cachefiles_dev_t)
+
 #
 # clock_device_t is the type of
 # /dev/rtc.
Signature · 1 line
1.7.11.4
author
#2 lore raw

PATCH 2/2 Implement files_create_all_files_as() for cachefilesd

In reply to Dominick Grift
Signed-off-by Dominick Grift <[email protected]>
---
 policy/modules/kernel/files.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
policy/modules/kernel/files.if +18 -0
index e1e814d..d1e42ac 100644
@@ -1182,6 +1182,24 @@ interface(`files_list_all',`
 
 ########################################
 ## <summary>
+##	Create all files as is.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_create_all_files_as',`
+	gen_require(`
+		attribute file_type;
+	')
+
+	allow $1 file_type:kernel_service create_files_as;
+')
+
+########################################
+## <summary>
 ##	Do not audit attempts to search the
 ##	contents of any directories on extended
 ##	attribute filesystems.
Signature · 1 line
1.7.11.4
#3 lore raw

cover Support cachefiles

In reply to Dominick Grift
Quoted 11 lines · Dominick Grift

These are needed by cachefilesd

Dominick Grift (2):
Declare a cachfiles device node type Implement files_create_all_files_as() for cachefilesd

 policy/modules/kernel/devices.fc |  1 +
 policy/modules/kernel/devices.if | 19 +++++++++++++++++++
 policy/modules/kernel/devices.te |  3 +++
 policy/modules/kernel/files.if   | 18 ++++++++++++++++++
 4 files changed, 41 insertions(+)

This set is merged, though I renamed the type to cachefiles_device_t.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#4 lore raw

cover Support cachefiles

In reply to Dominick Grift

What is the kernel_service class and create_file_as permission for?

Quoted 12 lines · Dominick Grift

These are needed by cachefilesd

Dominick Grift (2):
Declare a cachfiles device node type Implement files_create_all_files_as() for cachefilesd

 policy/modules/kernel/devices.fc |  1 +
 policy/modules/kernel/devices.if | 19 +++++++++++++++++++
 policy/modules/kernel/devices.te |  3 +++
 policy/modules/kernel/files.if   | 18 ++++++++++++++++++
 4 files changed, 41 insertions(+)
Quoted 8 lines

--
1.7.11.4

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://oss.tresys.com/pipermail/refpolicy/attachments/20121004/4357fca7/attachment-0001.html