LVM related updates
cover LVM related updates
Set of updates related to lvm operations.
Sven Vermeulen (4):
lvscan creates the /run/lock/lvm directory if nonexisting Allow lvtools to create cache folder
lvm needs read access to the event queue of udev Allow udev the block_suspend capability
policy/modules/system/lvm.te | 4 ++++ policy/modules/system/udev.te | 1 + 2 files changed, 5 insertions(+), 0 deletions(-)
Signature · 1 line
1.7.8.6
PATCH 1/4 lvscan creates the /run/lock/lvm directory if nonexisting
If the /run/lock/lvm directory doesn't exist yet, running any of the LVM tools (like lvscan) will create this directory. Introduce a named file transition for the lock location when a directory named "lvm" is created.
--- policy/modules/system/lvm.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/system/lvm.te +1 -0
@@ -193,6 +193,7 @@ can_exec(lvm_t, lvm_exec_t) # Creating lock files manage_files_pattern(lvm_t, lvm_lock_t, lvm_lock_t) files_lock_filetrans(lvm_t, lvm_lock_t, file) +files_lock_filetrans(lvm_t, lvm_lock_t, dir, "lvm") manage_dirs_pattern(lvm_t, lvm_var_lib_t, lvm_var_lib_t) manage_files_pattern(lvm_t, lvm_var_lib_t, lvm_var_lib_t)
Signature · 1 line
1.7.8.6
PATCH 1/4 lvscan creates the /run/lock/lvm directory if nonexisting
Quoted 14 lines · Sven Vermeulen
If the
/run/lock/lvmdirectory doesn't exist yet, running any of the LVM tools (like lvscan) will create this directory. Introduce a named file transition for the lock location when a directory named "lvm" is created.Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/system/lvm.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)policy/modules/system/lvm.te +0
-0
policy/modules/system/lvm.te can_exec(lvm_t, lvm_exec_t) · line 199
Quoted 7 lines
policy/modules/system/lvm.te +1
-0@@ -193,6 +193,7 @@ can_exec(lvm_t, lvm_exec_t) # Creating lock files manage_files_pattern(lvm_t, lvm_lock_t, lvm_lock_t) files_lock_filetrans(lvm_t, lvm_lock_t, file) +files_lock_filetrans(lvm_t, lvm_lock_t, dir, "lvm") manage_dirs_pattern(lvm_t, lvm_var_lib_t, lvm_var_lib_t) manage_files_pattern(lvm_t, lvm_var_lib_t, lvm_var_lib_t)
It looks like the permission to actually create the dirs is missing.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 2/4 Allow lvtools to create cache folder
In reply to Sven VermeulenThe lvscan application will create the /etc/lvm/cache folder if it doesn't exist yet.
--- policy/modules/system/lvm.te | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-)
policy/modules/system/lvm.te +2 -0
@@ -207,8 +207,10 @@ files_pid_filetrans(lvm_t, lvm_var_run_t, { file sock_file }) read_files_pattern(lvm_t, lvm_etc_t, lvm_etc_t) read_lnk_files_pattern(lvm_t, lvm_etc_t, lvm_etc_t) # Write to /etc/lvm, /etc/lvmtab, /etc/lvmtab.d +create_dirs_pattern(lvm_t, lvm_etc_t, lvm_metadata_t) manage_files_pattern(lvm_t, lvm_metadata_t, lvm_metadata_t) filetrans_pattern(lvm_t, lvm_etc_t, lvm_metadata_t, file) +filetrans_pattern(lvm_t, lvm_etc_t, lvm_metadata_t, dir, "cache") files_etc_filetrans(lvm_t, lvm_metadata_t, file) files_search_mnt(lvm_t)
Signature · 1 line
1.7.8.6
PATCH 3/4 lvm needs read access to the event queue of udev
In reply to Sven VermeulenThe udev event queue (queue.bin file) is located in the /run/udev folder and labeled udev_var_run_t. Hence, allow the lvm_t domain read access on this file.
Without this access, LVM operations that manipulate the volumes (like creating an additional logical volume) results in failures like the following:
/dev/vg/test: not found: device not cleared
Aborting. Failed to wipe start of new LV.
--- policy/modules/system/lvm.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/system/lvm.te +1 -0
@@ -343,6 +343,7 @@ optional_policy(` optional_policy(` udev_read_db(lvm_t) + udev_read_pid_files(lvm_t) ') optional_policy(`
Signature · 1 line
1.7.8.6
PATCH 4/4 Allow udev the block_suspend capability
In reply to Sven Vermeulen--- policy/modules/system/udev.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/system/udev.te +1 -0
@@ -39,6 +39,7 @@ ifdef(`enable_mcs',` allow udev_t self:capability { chown dac_override dac_read_search fowner fsetid sys_admin mknod net_raw net_admin sys_nice sys_rawio sys_resource setuid setgid sys_nice sys_ptrace }; dontaudit udev_t self:capability sys_tty_config; +allow udev_t self:capability2 block_suspend; allow udev_t self:process ~{ setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow udev_t self:process { execmem setfscreate }; allow udev_t self:fd use;
Signature · 1 line
1.7.8.6