Skip to contentSkip to conversation

File contexts for zram

PATCH New Jason Zaman 2 participants 6 messages Jun 23, 2014 – Jun 30, 2014

lore
Share & tools
lore

Jason Zaman

author
#0 lore raw

PATCH 1/1 File contexts for zram

zram is a compressed block device in ram

Signed-off-by Jason Zaman <[email protected]>
---
 policy/modules/kernel/storage.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/kernel/storage.fc +1 -0
index 4dd865b..73599f3 100644
@@ -59,6 +59,7 @@ ifdef(`distro_redhat', `
 /dev/zd.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /dev/zfs		-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /dev/zpios		-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zram[0-9]+		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 
 /dev/ataraid/.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
Signature · 1 line
1.8.5.5
author
#1 lore raw

PATCH 1/1 File Context for tumbler

Tumbler is a D-Bus service for applications to request thumbnails

Signed-off-by Jason Zaman <[email protected]>
---
 policy/modules/kernel/corecommands.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +1 -0
index 5961142..6a86cda 100644
@@ -244,6 +244,7 @@ ifdef(`distro_gentoo',`
 /usr/lib/xfce4/session/xfsm-shutdown-helper -- gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfconf/xfconfd	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfwm4/helper-dialog --	gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/tumbler-1/tumblerd	--	gen_context(system_u:object_r:bin_t,s0)
 
 /usr/lib/couchdb/erlang/lib/couch-[0-9.]+/priv/couchspawnkillable -- gen_context(system_u:object_r:bin_t,s0)
Signature · 1 line
1.8.5.5
#2 lore raw

PATCH 1/1 File Context for tumbler

Quoted 1 line · Jason Zaman

Tumbler is a D-Bus service for applications to request thumbnails

Perhaps I'm misunderstanding, but if this is a service, why aren't you creating a domain for this? Running a service in dbus's domain typically isn't the best choice.

Quoted 18 lines
Signed-off-by Jason Zaman <[email protected]>
---
 policy/modules/kernel/corecommands.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +1 -0
index 5961142..6a86cda 100644
@@ -244,6 +244,7 @@ ifdef(`distro_gentoo',`
 /usr/lib/xfce4/session/xfsm-shutdown-helper -- gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfconf/xfconfd	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfwm4/helper-dialog --	gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/tumbler-1/tumblerd	--	gen_context(system_u:object_r:bin_t,s0)
 
 /usr/lib/couchdb/erlang/lib/couch-[0-9.]+/priv/couchspawnkillable -- gen_context(system_u:object_r:bin_t,s0)
Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
author
#3 lore raw

PATCH 1/1 File Context for tumbler

Quoted 6 lines · Christopher J. PeBenito
Quoted 1 line · Jason Zaman

Tumbler is a D-Bus service for applications to request thumbnails

Perhaps I'm misunderstanding, but if this is a service, why aren't you creating a domain for this? Running a service in dbus's domain typically isn't the best choice.

It's not really a service, I just took that description from the xfce site. Its basically a helper utility that thunar (xfce's file manager) runs when it needs a thumbnail to display.

it's run by staff_dbus_t (or user_dbus_t etc) so it gets transitioned back into staff_t to run the tumbler service. Running in the user's domain seems okay to me since there isnt a specific xfce domain it should be running in. It isnt actually running in the dbus domain.

$ ps auxZ | grep tumbl
staff_u:staff_r:staff_t         jason    27822  1.3  0.2 529784 21860
?        SNl  00:43   0:00 /usr/lib64/tumbler-1/tumblerd
Quoted 1 line

From what i can see, gnome's file manager does not have its own domain

either so it would just end up running in staff_t or user_t same as this.

Quoted 24 lines
Quoted 12 lines
Signed-off-by Jason Zaman <[email protected]>
---
 policy/modules/kernel/corecommands.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +0 -0
index 5961142..6a86cda 100644

policy/modules/kernel/corecommands.fc ifdef(`distro_gentoo',` · line 250

Quoted 7 lines
policy/modules/kernel/corecommands.fc +1 -0
@@ -244,6 +244,7 @@ ifdef(`distro_gentoo',`
 /usr/lib/xfce4/session/xfsm-shutdown-helper -- gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfconf/xfconfd        --      gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfwm4/helper-dialog --        gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/tumbler-1/tumblerd  --      gen_context(system_u:object_r:bin_t,s0)
 
 /usr/lib/couchdb/erlang/lib/couch-[0-9.]+/priv/couchspawnkillable -- gen_context(system_u:object_r:bin_t,s0)

--
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

#4 lore raw

PATCH 1/1 File Context for tumbler

Quoted 9 lines · Jason Zaman
Quoted 6 lines · Christopher J. PeBenito
Quoted 1 line · Jason Zaman

Tumbler is a D-Bus service for applications to request thumbnails

Perhaps I'm misunderstanding, but if this is a service, why aren't you creating a domain for this? Running a service in dbus's domain typically isn't the best choice.

Quoted 8 lines

It's not really a service, I just took that description from the xfce site. Its basically a helper utility that thunar (xfce's file manager) runs when it needs a thumbnail to display.

it's run by staff_dbus_t (or user_dbus_t etc) so it gets transitioned back into staff_t to run the tumbler service. Running in the user's domain seems okay to me since there isnt a specific xfce domain it should be running in. It isnt actually running in the dbus domain.

Ok, I see where my confusion is. It is a DBus service, but it's for the user's session, not a system service.

Merged.

Quoted 16 lines
Quoted 16 lines
Quoted 16 lines
Signed-off-by Jason Zaman <[email protected]>
---
 policy/modules/kernel/corecommands.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/kernel/corecommands.fc +1 -0
index 5961142..6a86cda 100644
@@ -244,6 +244,7 @@ ifdef(`distro_gentoo',`
 /usr/lib/xfce4/session/xfsm-shutdown-helper -- gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfconf/xfconfd        --      gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/xfce4/xfwm4/helper-dialog --        gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/tumbler-1/tumblerd  --      gen_context(system_u:object_r:bin_t,s0)
 
 /usr/lib/couchdb/erlang/lib/couch-[0-9.]+/priv/couchspawnkillable -- gen_context(system_u:object_r:bin_t,s0)
Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com
#5 lore raw

PATCH 1/1 File contexts for zram

In reply to Jason Zaman
Quoted 12 lines · Jason Zaman

zram is a compressed block device in ram

Signed-off-by Jason Zaman <[email protected]>
---
 policy/modules/kernel/storage.fc | 1 +
 1 file changed, 1 insertion(+)
policy/modules/kernel/storage.fc +0 -0
index 4dd865b..73599f3 100644

policy/modules/kernel/storage.fc ifdef(`distro_redhat', ` · line 64

Quoted 6 lines
policy/modules/kernel/storage.fc +1 -0
@@ -59,6 +59,7 @@ ifdef(`distro_redhat', `
 /dev/zd.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /dev/zfs		-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 /dev/zpios		-c	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
+/dev/zram[0-9]+		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
 
 /dev/ataraid/.*		-b	gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com