Skip to contentSkip to conversation

Extending support for SELinux on ZFS

PATCH New Matthew Thode 2 participants 3 messages Dec 20, 2013 – Jan 21, 2014

lore
Share & tools
lore

Matthew Thode

author
#0 lore raw

PATCH 1/1 Extending support for SELinux on ZFS

Signed-off-by Matthew Thode <[email protected]>
---
 policy/modules/kernel/storage.fc | 5 +++++
 policy/modules/system/fstools.fc | 6 ++++++
 policy/modules/system/mount.fc   | 4 ++++
 3 files changed, 15 insertions(+)
policy/modules/kernel/storage.fc +5 -0
index 54f1827..4315bd5 100644
@@ -79,5 +79,10 @@ ifdef(`distro_redhat', `
 
 /dev/usb/rio500		-c	gen_context(system_u:object_r:removable_device_t,s0)
 
+/dev/zfs			-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zpios			-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zvol(/.*)?		-l	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zd.*			-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+
 /lib/udev/devices/loop.* -b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /lib/udev/devices/fuse	-c	gen_context(system_u:object_r:fuse_device_t,s0)
policy/modules/system/fstools.fc +6 -0
index 948ce2a..39e6c25 100644
@@ -36,6 +36,12 @@
 /sbin/swapoff		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /sbin/swapon.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /sbin/tune2fs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zpios			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/ztest			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zinject		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zhack			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zdb			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zstreamdump	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 
 /usr/bin/partition_uuid	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/raw		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
policy/modules/system/mount.fc +4 -0
index 4619000..a5e1c6e 100644
@@ -2,6 +2,10 @@
 /bin/mount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
 /bin/umount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
 
+/sbin/mount.zfs			--	gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/zpool				--	gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/zfs				--	gen_context(system_u:object_r:mount_exec_t,s0)
+
 /usr/bin/fusermount		--	gen_context(system_u:object_r:mount_exec_t,s0)
 
 /var/run/mount(/.*)?			gen_context(system_u:object_r:mount_var_run_t,s0)
Signature · 1 line
1.8.3.2
author
#1 lore raw

PATCH 1/1 Extending support for SELinux on ZFS

Quoted 45 lines · Matthew Thode
Signed-off-by Matthew Thode <[email protected]>
---
 policy/modules/kernel/storage.fc | 5 +++++
 policy/modules/system/fstools.fc | 6 ++++++
 policy/modules/system/mount.fc   | 4 ++++
 3 files changed, 15 insertions(+)
policy/modules/kernel/storage.fc +5 -0
index 54f1827..4315bd5 100644
@@ -79,5 +79,10 @@ ifdef(`distro_redhat', `
 
 /dev/usb/rio500		-c	gen_context(system_u:object_r:removable_device_t,s0)
 
+/dev/zfs			-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zpios			-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zvol(/.*)?		-l	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zd.*			-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+
 /lib/udev/devices/loop.* -b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /lib/udev/devices/fuse	-c	gen_context(system_u:object_r:fuse_device_t,s0)
policy/modules/system/fstools.fc +6 -0
index 948ce2a..39e6c25 100644
@@ -36,6 +36,12 @@
 /sbin/swapoff		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /sbin/swapon.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /sbin/tune2fs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zpios			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/ztest			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zinject		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zhack			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zdb			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zstreamdump	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 
 /usr/bin/partition_uuid	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/raw		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
policy/modules/system/mount.fc +0 -0
index 4619000..a5e1c6e 100644

policy/modules/system/mount.fc line 11

Quoted 10 lines
policy/modules/system/mount.fc +4 -0
@@ -2,6 +2,10 @@
 /bin/mount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
 /bin/umount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
 
+/sbin/mount.zfs			--	gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/zpool				--	gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/zfs				--	gen_context(system_u:object_r:mount_exec_t,s0)
+
 /usr/bin/fusermount		--	gen_context(system_u:object_r:mount_exec_t,s0)
 
 /var/run/mount(/.*)?			gen_context(system_u:object_r:mount_var_run_t,s0)

What's the status on the acceptance of this patch?

Signature · 9 lines
-- Matthew Thode

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: OpenPGP digital signature
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140120/e1d8a852/attachment.bin
#2 lore raw

PATCH 1/1 Extending support for SELinux on ZFS

Quoted 54 lines · Matthew Thode
Quoted 53 lines · Matthew Thode
Signed-off-by Matthew Thode <[email protected]>
---
 policy/modules/kernel/storage.fc | 5 +++++
 policy/modules/system/fstools.fc | 6 ++++++
 policy/modules/system/mount.fc   | 4 ++++
 3 files changed, 15 insertions(+)
policy/modules/kernel/storage.fc +5 -0
index 54f1827..4315bd5 100644
@@ -79,5 +79,10 @@ ifdef(`distro_redhat', `
 
 /dev/usb/rio500		-c	gen_context(system_u:object_r:removable_device_t,s0)
 
+/dev/zfs			-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zpios			-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zvol(/.*)?		-l	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zd.*			-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+
 /lib/udev/devices/loop.* -b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /lib/udev/devices/fuse	-c	gen_context(system_u:object_r:fuse_device_t,s0)
policy/modules/system/fstools.fc +6 -0
index 948ce2a..39e6c25 100644
@@ -36,6 +36,12 @@
 /sbin/swapoff		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /sbin/swapon.*		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /sbin/tune2fs		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zpios			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/ztest			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zinject		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zhack			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zdb			--	gen_context(system_u:object_r:fsadm_exec_t,s0)
+/sbin/zstreamdump	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 
 /usr/bin/partition_uuid	--	gen_context(system_u:object_r:fsadm_exec_t,s0)
 /usr/bin/raw		--	gen_context(system_u:object_r:fsadm_exec_t,s0)
policy/modules/system/mount.fc +4 -0
index 4619000..a5e1c6e 100644
@@ -2,6 +2,10 @@
 /bin/mount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
 /bin/umount.*			--	gen_context(system_u:object_r:mount_exec_t,s0)
 
+/sbin/mount.zfs			--	gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/zpool				--	gen_context(system_u:object_r:mount_exec_t,s0)
+/sbin/zfs				--	gen_context(system_u:object_r:mount_exec_t,s0)
+
 /usr/bin/fusermount		--	gen_context(system_u:object_r:mount_exec_t,s0)
Quoted 3 lines

policy/modules/system/mount.fc line 11

Quoted 2 lines
policy/modules/system/mount.fc +0 -0
 /var/run/mount(/.*)?			gen_context(system_u:object_r:mount_var_run_t,s0)

What's the status on the acceptance of this patch?

Sorry, I lost track of it. Its committed now, though I removed the symlink label and rearranged the lines.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com