Skip to contentSkip to conversation

Label /usr/share/virtualbox/VBoxCreateUSBNode.sh as udev_helper_exec_t

PATCH New Nicolas Iooss 2 participants 2 messages Apr 14, 2014 – Apr 21, 2014

lore
Share & tools
lore

Nicolas Iooss

author
#0 lore raw

PATCH 1/1 Label /usr/share/virtualbox/VBoxCreateUSBNode.sh as udev_helper_exec_t

VBoxCreateUSBNode.sh creates character special files in /dev/vboxusb each time a new USB device appears. This script is called by udev.

audit.log on a system in permissive mode before this patch contains:

    type=AVC msg=audit(1396889711.890:175): avc:  denied  { execute } for  pid=26284 comm="systemd-udevd" name="VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file
    type=AVC msg=audit(1396889711.890:175): avc:  denied  { execute_no_trans } for  pid=26284 comm="systemd-udevd" path="/usr/share/virtualbox/VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file
---
 policy/modules/system/udev.fc | 2 ++
 1 file changed, 2 insertions(+)
policy/modules/system/udev.fc +2 -0
index 0b4df21..9c5ea54 100644
@@ -31,6 +31,8 @@ ifdef(`distro_redhat',`
 
 /usr/lib/systemd/systemd-udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
 
+/usr/share/virtualbox/VBoxCreateUSBNode\.sh	--	gen_context(system_u:object_r:udev_helper_exec_t,s0)
+
 /var/run/udev(/.*)?	gen_context(system_u:object_r:udev_var_run_t,s0)
 
 ifdef(`distro_debian',`
Signature · 1 line
1.9.1
#1 lore raw

PATCH 1/1 Label /usr/share/virtualbox/VBoxCreateUSBNode.sh as udev_helper_exec_t

Quoted 16 lines · Nicolas Iooss

VBoxCreateUSBNode.sh creates character special files in /dev/vboxusb each time a new USB device appears. This script is called by udev.

audit.log on a system in permissive mode before this patch contains:

    type=AVC msg=audit(1396889711.890:175): avc:  denied  { execute } for  pid=26284 comm="systemd-udevd" name="VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file
    type=AVC msg=audit(1396889711.890:175): avc:  denied  { execute_no_trans } for  pid=26284 comm="systemd-udevd" path="/usr/share/virtualbox/VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file
---
 policy/modules/system/udev.fc | 2 ++
 1 file changed, 2 insertions(+)
policy/modules/system/udev.fc +0 -0
index 0b4df21..9c5ea54 100644

policy/modules/system/udev.fc ifdef(`distro_redhat',` · line 38

Quoted 8 lines
policy/modules/system/udev.fc +2 -0
@@ -31,6 +31,8 @@ ifdef(`distro_redhat',`
 
 /usr/lib/systemd/systemd-udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
 
+/usr/share/virtualbox/VBoxCreateUSBNode\.sh	--	gen_context(system_u:object_r:udev_helper_exec_t,s0)
+
 /var/run/udev(/.*)?	gen_context(system_u:object_r:udev_var_run_t,s0)
 
 ifdef(`distro_debian',`

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com