system/mount.if: Add mount_rw_loopback_files interface

PATCH New Luis Ressel 2 participants 7 messages Aug 11, 2014 – Aug 19, 2014

Share & tools

Luis Ressel

author

2014-08-11 13:33 UTC #0 lore raw

PATCH 1/3 system/mount.if: Add mount_rw_loopback_files interface

---
 policy/modules/system/mount.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

policy/modules/system/mount.if +18 -0

index fe24186..8a2105b 100644
@@ -191,3 +191,21 @@ interface(`mount_read_loopback_files',`
 
 	allow $1 mount_loopback_t:file read_file_perms;
 ')
+
+########################################
+## <summary>
+##	Read and write loopback filesystem image files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mount_rw_loopback_files',`
+	gen_require(`
+		type mount_loopback_t;
+	')
+
+	allow $1 mount_loopback_t:file rw_file_perms;
+')

Signature · 1 line

2.0.4

Luis Ressel

author

2014-08-11 13:33 UTC #1 lore raw

PATCH 2/3 system/fstools.if: Add fstools_use_fds interface

---
 policy/modules/system/fstools.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

policy/modules/system/fstools.if +18 -0

index 016a770..c4bbd88 100644
@@ -83,6 +83,24 @@ interface(`fstools_signal',`
 
 ########################################
 ## <summary>
+##	Inherit fstools file descriptors.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`fstools_use_fds',`
+	gen_require(`
+		type fsadm_t;
+	')
+
+	allow $1 fsadm_t:fd use;
+')
+
+########################################
+## <summary>
 ##	Read fstools unnamed pipes.
 ## </summary>
 ## <param name="domain">

Signature · 1 line

2.0.4

Luis Ressel

author

2014-08-11 13:33 UTC #2 lore raw

PATCH 3/3 Add neccessary permissions for losetup

In reply to Luis Ressel

This allows losetup to bind mount_loopback_t files to loop devices.

---
 policy/modules/kernel/kernel.te  | 5 +++++
 policy/modules/system/fstools.te | 5 +++++
 2 files changed, 10 insertions(+)

policy/modules/kernel/kernel.te +5 -0

index 7fe10c3..777f180 100644
@@ -300,6 +300,11 @@ ifdef(`distro_redhat',`
 ')
 
 optional_policy(`
+	# loop devices
+	fsadm_use_fds(kernel_t)
+')
+
+optional_policy(`
 	hotplug_search_config(kernel_t)
 ')

policy/modules/system/fstools.te +5 -0

index b876224..1d40813 100644
@@ -94,6 +94,8 @@ dev_rw_sysfs(fsadm_t)
 dev_getattr_usbfs_dirs(fsadm_t)
 # Access to /dev/mapper/control
 dev_rw_lvm_control(fsadm_t)
+# for losetup
+dev_rw_loop_control(fsadm_t)
 
 domain_use_interactive_fds(fsadm_t)

@@ -125,6 +127,9 @@ files_search_all(fsadm_t)
 mls_file_read_all_levels(fsadm_t)
 mls_file_write_all_levels(fsadm_t)
 
+# losetup: bind mount_loopback_t files to loop devices
+mount_rw_loopback_files(fsadm_t)
+
 storage_raw_read_fixed_disk(fsadm_t)
 storage_raw_write_fixed_disk(fsadm_t)
 storage_raw_read_removable_device(fsadm_t)

Signature · 1 line

2.0.4

Luis Ressel

author

2014-08-11 13:37 UTC #3 lore raw

PATCH 3/3 Add neccessary permissions for losetup

Quoted 14 lines · On Mon, 11 Aug 2014 15:33:18 +0200 Luis Ressel <[email protected]> wrote:

(quoted diff) +0 -0
b/policy/modules/system/fstools.te index b876224..1d40813 100644
policy/modules/system/fstools.te +2 -0
@@ -94,6 +94,8 @@ dev_rw_sysfs(fsadm_t)
 dev_getattr_usbfs_dirs(fsadm_t)
 # Access to /dev/mapper/control
 dev_rw_lvm_control(fsadm_t)
+# for losetup
+dev_rw_loop_control(fsadm_t)
 
 domain_use_interactive_fds(fsadm_t)
 

policy/modules/system/fstools.te files_search_all(fsadm_t) · line 135

Quoted 9 lines

policy/modules/system/fstools.te +3 -0

@@ -125,6 +127,9 @@ files_search_all(fsadm_t)
 mls_file_read_all_levels(fsadm_t)
 mls_file_write_all_levels(fsadm_t)
 
+# losetup: bind mount_loopback_t files to loop devices
+mount_rw_loopback_files(fsadm_t)
+
 storage_raw_read_fixed_disk(fsadm_t)
 storage_raw_write_fixed_disk(fsadm_t)
 storage_raw_read_removable_device(fsadm_t)

I hope these are at the correct positions now as Chris requested.

Regards,
Luis Ressel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140811/9a409739/attachment.bin

Luis Ressel

author

2014-08-11 22:19 UTC #4 lore raw

PATCH 3/3 Add neccessary permissions for losetup

In reply to Luis Ressel

policy/modules/kernel/kernel.te ifdef(`distro_redhat',` · line 309

Quoted 8 lines · On Mon, 11 Aug 2014 15:33:18 +0200 Luis Ressel <[email protected]> wrote:

optional_policy(`

policy/modules/kernel/kernel.te +5 -0

+	# loop devices
+	fsadm_use_fds(kernel_t)
+')
+
+optional_policy(`
 	hotplug_search_config(kernel_t)
 ')

Whoops, that patch is faulty, it should be fstools_use_fds() of course.
I'll send a new patch.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20140812/bdc8a21b/attachment.bin

Luis Ressel

author

2014-08-11 22:24 UTC #5 lore raw

PATCH v2 3/3 Add neccessary permissions for losetup

This allows losetup to bind mount_loopback_t files to loop devices.

---
 policy/modules/kernel/kernel.te  | 5 +++++
 policy/modules/system/fstools.te | 5 +++++
 2 files changed, 10 insertions(+)

policy/modules/kernel/kernel.te +5 -0

index 7fe10c3..fdd5b8d 100644
@@ -300,6 +300,11 @@ ifdef(`distro_redhat',`
 ')
 
 optional_policy(`
+	# loop devices
+	fstools_use_fds(kernel_t)
+')
+
+optional_policy(`
 	hotplug_search_config(kernel_t)
 ')

policy/modules/system/fstools.te +5 -0

index b876224..1d40813 100644
@@ -94,6 +94,8 @@ dev_rw_sysfs(fsadm_t)
 dev_getattr_usbfs_dirs(fsadm_t)
 # Access to /dev/mapper/control
 dev_rw_lvm_control(fsadm_t)
+# for losetup
+dev_rw_loop_control(fsadm_t)
 
 domain_use_interactive_fds(fsadm_t)

@@ -125,6 +127,9 @@ files_search_all(fsadm_t)
 mls_file_read_all_levels(fsadm_t)
 mls_file_write_all_levels(fsadm_t)
 
+# losetup: bind mount_loopback_t files to loop devices
+mount_rw_loopback_files(fsadm_t)
+
 storage_raw_read_fixed_disk(fsadm_t)
 storage_raw_write_fixed_disk(fsadm_t)
 storage_raw_read_removable_device(fsadm_t)

Signature · 1 line

2.0.4

Christopher J. PeBenito

2014-08-19 12:46 UTC #6 lore raw

PATCH v2 3/3 Add neccessary permissions for losetup

Quoted 1 line · Luis Ressel

This allows losetup to bind mount_loopback_t files to loop devices.

This set is merged.

Quoted 45 lines

---
 policy/modules/kernel/kernel.te  | 5 +++++
 policy/modules/system/fstools.te | 5 +++++
 2 files changed, 10 insertions(+)

policy/modules/kernel/kernel.te +5 -0

index 7fe10c3..fdd5b8d 100644
@@ -300,6 +300,11 @@ ifdef(`distro_redhat',`
 ')
 
 optional_policy(`
+	# loop devices
+	fstools_use_fds(kernel_t)
+')
+
+optional_policy(`
 	hotplug_search_config(kernel_t)
 ')

policy/modules/system/fstools.te +5 -0

index b876224..1d40813 100644
@@ -94,6 +94,8 @@ dev_rw_sysfs(fsadm_t)
 dev_getattr_usbfs_dirs(fsadm_t)
 # Access to /dev/mapper/control
 dev_rw_lvm_control(fsadm_t)
+# for losetup
+dev_rw_loop_control(fsadm_t)
 
 domain_use_interactive_fds(fsadm_t)

@@ -125,6 +127,9 @@ files_search_all(fsadm_t)
 mls_file_read_all_levels(fsadm_t)
 mls_file_write_all_levels(fsadm_t)
 
+# losetup: bind mount_loopback_t files to loop devices
+mount_rw_loopback_files(fsadm_t)
+
 storage_raw_read_fixed_disk(fsadm_t)
 storage_raw_write_fixed_disk(fsadm_t)
 storage_raw_read_removable_device(fsadm_t)

Signature · 3 lines

Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com