Skip to contentSkip to conversation

Label /etc/selinux/([^/]*/)?modules(/.*)? as semanage_store_t

PATCH New Laurent Bigonville 2 participants 2 messages Jan 15, 2014 – Jan 17, 2014

lore
Share & tools
lore

Laurent Bigonville

author
#0 lore raw

PATCH 1/1 Label /etc/selinux/([^/]*/)?modules(/.*)? as semanage_store_t

From: Laurent Bigonville <[email protected]>

Move the filetrans_patern out of the seutil_manage_module_store interface as only semanage_t should be creating this directory

---
 policy/modules/system/selinuxutil.fc | 2 +-
 policy/modules/system/selinuxutil.if | 1 -
 policy/modules/system/selinuxutil.te | 2 ++
 3 files changed, 3 insertions(+), 2 deletions(-)
policy/modules/system/selinuxutil.fc +1 -1
index d43f3b1..ec19d63 100644
@@ -9,7 +9,7 @@
 /etc/selinux/([^/]*/)?policy(/.*)?	gen_context(system_u:object_r:policy_config_t,mls_systemhigh)
 /etc/selinux/([^/]*/)?setrans\.conf --	gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
 /etc/selinux/([^/]*/)?seusers	--	gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
-/etc/selinux/([^/]*/)?modules/(active|tmp|previous)(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
+/etc/selinux/([^/]*/)?modules(/.*)?	gen_context(system_u:object_r:semanage_store_t,s0)
 /etc/selinux/([^/]*/)?modules/semanage\.read\.LOCK -- gen_context(system_u:object_r:semanage_read_lock_t,s0)
 /etc/selinux/([^/]*/)?modules/semanage\.trans\.LOCK -- gen_context(system_u:object_r:semanage_trans_lock_t,s0)
 /etc/selinux/([^/]*/)?users(/.*)? --	gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
policy/modules/system/selinuxutil.if +0 -1
index e5ff626..bee06f4 100644
@@ -1044,7 +1044,6 @@ interface(`seutil_manage_module_store',`
 	manage_dirs_pattern($1, selinux_config_t, semanage_store_t)
 	manage_files_pattern($1, semanage_store_t, semanage_store_t)
 	manage_lnk_files_pattern($1, semanage_store_t, semanage_store_t)
-	filetrans_pattern($1, selinux_config_t, semanage_store_t, dir, "modules")
 ')
 
 #######################################
policy/modules/system/selinuxutil.te +2 -0
index 551ac96..cb5610f 100644
@@ -448,6 +448,8 @@ allow semanage_t self:fifo_file rw_fifo_file_perms;
 
 allow semanage_t policy_config_t:file rw_file_perms;
 
+filetrans_pattern(semanage_t, selinux_config_t, semanage_store_t, dir, "modules")
+
 allow semanage_t semanage_tmp_t:dir manage_dir_perms;
 allow semanage_t semanage_tmp_t:file manage_file_perms;
 files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir })
Signature · 1 line
1.8.5.2
#1 lore raw

PATCH 1/1 Label /etc/selinux/([^/]*/)?modules(/.*)? as semanage_store_t

Quoted 40 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

Move the filetrans_patern out of the seutil_manage_module_store interface as only semanage_t should be creating this directory

---
 policy/modules/system/selinuxutil.fc | 2 +-
 policy/modules/system/selinuxutil.if | 1 -
 policy/modules/system/selinuxutil.te | 2 ++
 3 files changed, 3 insertions(+), 2 deletions(-)
policy/modules/system/selinuxutil.fc +1 -1
index d43f3b1..ec19d63 100644
@@ -9,7 +9,7 @@
 /etc/selinux/([^/]*/)?policy(/.*)?	gen_context(system_u:object_r:policy_config_t,mls_systemhigh)
 /etc/selinux/([^/]*/)?setrans\.conf --	gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
 /etc/selinux/([^/]*/)?seusers	--	gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
-/etc/selinux/([^/]*/)?modules/(active|tmp|previous)(/.*)? gen_context(system_u:object_r:semanage_store_t,s0)
+/etc/selinux/([^/]*/)?modules(/.*)?	gen_context(system_u:object_r:semanage_store_t,s0)
 /etc/selinux/([^/]*/)?modules/semanage\.read\.LOCK -- gen_context(system_u:object_r:semanage_read_lock_t,s0)
 /etc/selinux/([^/]*/)?modules/semanage\.trans\.LOCK -- gen_context(system_u:object_r:semanage_trans_lock_t,s0)
 /etc/selinux/([^/]*/)?users(/.*)? --	gen_context(system_u:object_r:selinux_config_t,mls_systemhigh)
policy/modules/system/selinuxutil.if +0 -1
index e5ff626..bee06f4 100644
@@ -1044,7 +1044,6 @@ interface(`seutil_manage_module_store',`
 	manage_dirs_pattern($1, selinux_config_t, semanage_store_t)
 	manage_files_pattern($1, semanage_store_t, semanage_store_t)
 	manage_lnk_files_pattern($1, semanage_store_t, semanage_store_t)
-	filetrans_pattern($1, selinux_config_t, semanage_store_t, dir, "modules")
 ')
 
 #######################################
policy/modules/system/selinuxutil.te +0 -0
index 551ac96..cb5610f 100644

policy/modules/system/selinuxutil.te allow semanage_t self:fifo_file rw_fifo_file_perms; · line 455

Quoted 8 lines
policy/modules/system/selinuxutil.te +2 -0
@@ -448,6 +448,8 @@ allow semanage_t self:fifo_file rw_fifo_file_perms;
 
 allow semanage_t policy_config_t:file rw_file_perms;
 
+filetrans_pattern(semanage_t, selinux_config_t, semanage_store_t, dir, "modules")
+
 allow semanage_t semanage_tmp_t:dir manage_dir_perms;
 allow semanage_t semanage_tmp_t:file manage_file_perms;
 files_tmp_filetrans(semanage_t, semanage_tmp_t, { file dir })

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com