Skip to contentSkip to conversation

Add interfaces to read/write /proc/sys/vm/overcommit_memory

PATCH Superseded Laurent Bigonville 2 participants 3 messages Dec 11, 2015 – Dec 14, 2015

lore
Share & tools
lore

Laurent Bigonville

author
#0 lore raw

PATCH v2 1/1 Add interfaces to read/write /proc/sys/vm/overcommit_memory

From: Laurent Bigonville <[email protected]>

---
 policy/modules/kernel/kernel.if | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
policy/modules/kernel/kernel.if +40 -0
index f1130d1..e0f23ec 100644
@@ -3323,3 +3323,43 @@ interface(`kernel_unconfined',`
 	typeattribute $1 kern_unconfined;
 	kernel_load_module($1)
 ')
+
+########################################
+## <summary>
+##	Read virtual memory overcommit sysctl.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`kernel_read_vm_overcommit_sysctl',`
+	gen_require(`
+		type sysctl_vm_overcommit_t;
+	')
+
+	kernel_search_vm_sysctl($1)
+	allow $1 sysctl_vm_overcommit_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+##	Read and write virtual memory overcommit sysctl.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`kernel_rw_vm_overcommit_sysctl',`
+	gen_require(`
+		type sysctl_vm_overcommit_t;
+	')
+
+	kernel_search_vm_sysctl($1)
+	allow $1 sysctl_vm_overcommit_t:file rw_file_perms;
+')
Signature · 1 line
2.6.4
author
#1 lore raw

PATCH v2 1/1 Add interfaces to read/write /proc/sys/vm/overcommit_memory

Le 11/12/15 14:03, Laurent Bigonville a ?crit :

Quoted 15 lines

From: Laurent Bigonville <[email protected]>

---
  policy/modules/kernel/kernel.if | 40 ++++++++++++++++++++++++++++++++++++++++
  1 file changed, 40 insertions(+)
policy/modules/kernel/kernel.if +1 -0
index f1130d1..e0f23ec 100644
@@ -3323,3 +3323,43 @@ interface(`kernel_unconfined',`
  	typeattribute $1 kern_unconfined;
  	kernel_load_module($1)
  ')
+

policy/modules/kernel/kernel.if interface(`kernel_unconfined',` · line 3336

Quoted 10 lines
policy/modules/kernel/kernel.if +10 -0
+########################################
+## <summary>
+##	Read virtual memory overcommit sysctl.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>

Mhh I guess the rolecap should be removed?

Quoted 29 lines
policy/modules/kernel/kernel.if +29 -0
+#
+interface(`kernel_read_vm_overcommit_sysctl',`
+	gen_require(`
+		type sysctl_vm_overcommit_t;
+	')
+
+	kernel_search_vm_sysctl($1)
+	allow $1 sysctl_vm_overcommit_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+##	Read and write virtual memory overcommit sysctl.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`kernel_rw_vm_overcommit_sysctl',`
+	gen_require(`
+		type sysctl_vm_overcommit_t;
+	')
+
+	kernel_search_vm_sysctl($1)
+	allow $1 sysctl_vm_overcommit_t:file rw_file_perms;
+')
#2 lore raw

PATCH v2 1/1 Add interfaces to read/write /proc/sys/vm/overcommit_memory

In reply to Laurent Bigonville
Quoted 44 lines · Laurent Bigonville

From: Laurent Bigonville <[email protected]>

---
 policy/modules/kernel/kernel.if | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
policy/modules/kernel/kernel.if +30 -0
index f1130d1..e0f23ec 100644
@@ -3323,3 +3323,43 @@ interface(`kernel_unconfined',`
 	typeattribute $1 kern_unconfined;
 	kernel_load_module($1)
 ')
+
+########################################
+## <summary>
+##	Read virtual memory overcommit sysctl.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`kernel_read_vm_overcommit_sysctl',`
+	gen_require(`
+		type sysctl_vm_overcommit_t;
+	')
+
+	kernel_search_vm_sysctl($1)
+	allow $1 sysctl_vm_overcommit_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+##	Read and write virtual memory overcommit sysctl.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>

policy/modules/kernel/kernel.if interface(`kernel_unconfined',` · line 3365

Quoted 10 lines
policy/modules/kernel/kernel.if +10 -0
+## <rolecap/>
+#
+interface(`kernel_rw_vm_overcommit_sysctl',`
+	gen_require(`
+		type sysctl_vm_overcommit_t;
+	')
+
+	kernel_search_vm_sysctl($1)
+	allow $1 sysctl_vm_overcommit_t:file rw_file_perms;
+')

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com