Make unconfined user run lvm programs in confined domain
PATCH 1/1 Make unconfined user run lvm programs in confined domain
When an unconfined user uses truecrypt to mount an encrypted file, dmsetup is called to setup a new device. This program works with udev to configure the new device and uses SysV semaphores to synchronize states. As udev runs dmsetup in lvm_t domain, the first dmsetup process needs to create lvm_t semaphores (not unconfined_t) and hence needs to run in lvm_t domain.
More details are available in the archives on the ML:
http://oss.tresys.com/pipermail/refpolicy/2014-May/007111.html
--- policy/modules/system/unconfined.te | 4 ++++ 1 file changed, 4 insertions(+)
policy/modules/system/unconfined.te +4 -0
@@ -108,6 +108,10 @@ optional_policy(` ') optional_policy(` + lvm_run(unconfined_t, unconfined_r) +') + +optional_policy(` modutils_run_update_mods(unconfined_t, unconfined_r) ')
Signature · 1 line
1.9.2
PATCH 1/1 Make unconfined user run lvm programs in confined domain
Quoted 17 lines · Nicolas Iooss
When an unconfined user uses truecrypt to mount an encrypted file, dmsetup is called to setup a new device. This program works with udev to configure the new device and uses SysV semaphores to synchronize states. As udev runs dmsetup in
lvm_tdomain, the first dmsetup process needs to createlvm_tsemaphores (notunconfined_t) and hence needs to run inlvm_tdomain.More details are available in the archives on the ML:
http://oss.tresys.com/pipermail/refpolicy/2014-May/007111.html--- policy/modules/system/unconfined.te | 4 ++++ 1 file changed, 4 insertions(+)policy/modules/system/unconfined.te +0
-0
policy/modules/system/unconfined.te optional_policy(` · line 116
Quoted 9 lines
policy/modules/system/unconfined.te +4
-0@@ -108,6 +108,10 @@ optional_policy(` ') optional_policy(` + lvm_run(unconfined_t, unconfined_r) +') + +optional_policy(` modutils_run_update_mods(unconfined_t, unconfined_r) ')
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Make unconfined user run lvm programs in confined domain
Quoted 20 lines · Christopher J. PeBenito
Quoted 19 lines · Nicolas Iooss
When an unconfined user uses truecrypt to mount an encrypted file, dmsetup is called to setup a new device. This program works with udev to configure the new device and uses SysV semaphores to synchronize states. As udev runs dmsetup in
lvm_tdomain, the first dmsetup process needs to createlvm_tsemaphores (notunconfined_t) and hence needs to run inlvm_tdomain.More details are available in the archives on the ML:
http://oss.tresys.com/pipermail/refpolicy/2014-May/007111.html--- policy/modules/system/unconfined.te | 4 ++++ 1 file changed, 4 insertions(+)policy/modules/system/unconfined.te +0
-0@@ -108,6 +108,10 @@ optional_policy(` ')
Quoted 9 lines
policy/modules/system/unconfined.te optional_policy(` · line 116
Quoted 7 lines
policy/modules/system/unconfined.te +4
-0optional_policy(` + lvm_run(unconfined_t, unconfined_r) +') + +optional_policy(` modutils_run_update_mods(unconfined_t, unconfined_r) ')Merged.
Why would we add a confinement to the unconfined domain? I believe unconfined_t should stay unconfined as much as possible.
I wrote a blog about this.
https://danwalsh.livejournal.com/30084.html
The only reason to do this in the past was for correct labeling, but with file name transition rules, I believe almost all transitions from unconfined_t should be eliminated.
PATCH 1/1 Make unconfined user run lvm programs in confined domain
Quoted 34 lines · Daniel J Walsh
Quoted 20 lines · Christopher J. PeBenito
Quoted 19 lines · Nicolas Iooss
When an unconfined user uses truecrypt to mount an encrypted file, dmsetup is called to setup a new device. This program works with udev to configure the new device and uses SysV semaphores to synchronize states. As udev runs dmsetup in
lvm_tdomain, the first dmsetup process needs to createlvm_tsemaphores (notunconfined_t) and hence needs to run inlvm_tdomain.More details are available in the archives on the ML:
http://oss.tresys.com/pipermail/refpolicy/2014-May/007111.html--- policy/modules/system/unconfined.te | 4 ++++ 1 file changed, 4 insertions(+)policy/modules/system/unconfined.te +0
-0@@ -108,6 +108,10 @@ optional_policy(` ')Quoted 9 lines
policy/modules/system/unconfined.te optional_policy(` · line 116
Quoted 7 lines
policy/modules/system/unconfined.te +4
-0optional_policy(` + lvm_run(unconfined_t, unconfined_r) +') + +optional_policy(` modutils_run_update_mods(unconfined_t, unconfined_r) ')Merged.
Why would we add a confinement to the unconfined domain? I believe
unconfined_tshould stay unconfined as much as possible.
Quoted 7 lines
I wrote a blog about this.
https://danwalsh.livejournal.com/30084.html
The only reason to do this in the past was for correct labeling, but with file name transition rules, I believe almost all transitions from
unconfined_tshould be eliminated.
The file name transitions don't apply, as we're concerned about SysV semaphores in this case.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com