devtmpfs patch

index f35d1d8..fde534a 100644
@@ -9,6 +9,7 @@ attribute exec_type;
 
 type bin_t alias { ls_exec_t sbin_t };
 corecmd_executable_file(bin_t)
+dev_associate(bin_t)
 
 type shell_exec_t;
 corecmd_executable_file(shell_exec_t)

105 lines not on this page · raw message

index 61d3f7f..8fb22a4 100644
@@ -15,6 +15,8 @@ fs_associate_tmpfs(device_t)
 files_type(device_t)
 files_mountpoint(device_t)
 files_associate_tmp(device_t)
+fs_type(device_t)
+fs_use_trans devtmpfs gen_context(system_u:object_r:device_t,s0);
 
 type agp_device_t;
 dev_node(agp_device_t)

@@ -182,6 +184,8 @@ fs_associate_tmpfs(device_node)
 
 files_associate_tmp(device_node)
 
+allow device_node device_t:filesystem associate;
+
 ########################################
 #
 # Unconfined access to this module

90 lines not on this page · raw message

index 1afbf01..1690986 100644
@@ -157,8 +157,8 @@ fs_type(tmpfs_t)
 files_type(tmpfs_t)
 files_mountpoint(tmpfs_t)
 files_poly_parent(tmpfs_t)
+dev_associate(tmpfs_t)
 
-fs_use_trans devtmpfs gen_context(system_u:object_r:tmpfs_t,s0);
 fs_use_trans mqueue gen_context(system_u:object_r:tmpfs_t,s0);
 fs_use_trans shm gen_context(system_u:object_r:tmpfs_t,s0);
 fs_use_trans tmpfs gen_context(system_u:object_r:tmpfs_t,s0);

index 77de0fc..53a8f58 100644
@@ -149,6 +149,7 @@ allow kernel_t self:unix_dgram_socket sendto;
 allow kernel_t self:unix_stream_socket connectto;
 allow kernel_t self:fifo_file rw_fifo_file_perms;
 allow kernel_t self:sock_file read_sock_file_perms;
+allow kernel_t self:system module_request;
 allow kernel_t self:fd use;
 
 allow kernel_t debugfs_t:dir search_dir_perms;

@@ -195,13 +196,21 @@ dev_create_generic_blk_files(kernel_t)
 dev_delete_generic_blk_files(kernel_t)
 dev_create_generic_chr_files(kernel_t)
 dev_delete_generic_chr_files(kernel_t)
-dev_tmpfs_filetrans_dev(kernel_t, { dir blk_file chr_file })
+
+dev_mounton_generic_dirs(kernel_t) #byme
+dev_setattr_generic_chr_files(kernel_t) #byme
+dev_rw_generic_chr_files(kernel_t) #byme
+dev_rw_dri(kernel_t) #byme
+dev_write_kmsg(kernel_t) #byme
 
 fs_mount_all_fs(kernel_t)
 fs_unmount_all_fs(kernel_t)
+fs_read_anon_inodefs_files(kernel_t)
 
 selinux_load_policy(kernel_t)
 
+seutil_run_setfiles(kernel_t, system_r)
+
 term_use_all_terms(kernel_t)
 term_use_ptmx(kernel_t)
 

@@ -218,6 +227,11 @@ files_list_home(kernel_t)
 files_read_usr_files(kernel_t)
 files_manage_mounttab(kernel_t)
 files_manage_generic_spool_dirs(kernel_t)
+files_exec_root_files(kernel_t) #byme
+files_manage_root_files(kernel_t) #byme
+files_delete_root_dirs(kernel_t) #byme
+files_delete_root_lnk_files(kernel_t) #byme
+files_delete_root_chr_files(kernel_t) # byme
 
 mcs_process_set_categories(kernel_t)
 mcs_file_read_all(kernel_t)

@@ -240,6 +254,10 @@ ifdef(`distro_redhat',`
 userdom_user_home_dir_filetrans_user_home_content(kernel_t, { file dir })
 
 optional_policy(`
+	bluetooth_stream_connect(kernel_t) #byme
+')
+
+optional_policy(`
 	hotplug_search_config(kernel_t)
 ')
 

@@ -261,6 +279,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	plymouthd_manage_lib_files(kernel_t) #byme
+')
+
+optional_policy(`
 	allow kernel_t self:tcp_socket create_stream_socket_perms;
 	allow kernel_t self:udp_socket create_socket_perms;
 

@@ -308,9 +330,13 @@ optional_policy(`
 ')
 
 optional_policy(`
-	unconfined_domain_noaudit(kernel_t)
+	udev_delete_db_files(kernel_t) #byme
 ')
 
+# optional_policy(`
+#	unconfined_domain_noaudit(kernel_t)
+#')
+
 optional_policy(`
 	xserver_xdm_manage_spool(kernel_t)
 ')

index 756190f..6cf2a03 100644
@@ -19,6 +19,7 @@ dev_node(console_device_t)
 type devpts_t;
 files_mountpoint(devpts_t)
 fs_associate_tmpfs(devpts_t)
+dev_associate(devpts_t)
 fs_type(devpts_t)
 fs_use_trans devpts gen_context(system_u:object_r:devpts_t,s0);
 

index 6bfa9db..a5ddba0 100644
@@ -107,9 +107,8 @@ files_pid_filetrans(init_t, init_var_run_t, file)
 
 allow init_t initctl_t:fifo_file manage_fifo_file_perms;
 dev_filetrans(init_t, initctl_t, fifo_file)
-fs_associate_tmpfs(initctl_t)
 
-allow init_t initrc_var_run_t:file { rw_file_perms setattr };
+allow init_t initrc_var_run_t:file { rw_file_perms setattr_file_perms};
 
 kernel_read_system_state(init_t)
 kernel_share_state(init_t)

index 56c1942..6e46966 100644
@@ -465,6 +465,9 @@ seutil_manage_config(setsebool_t)
 # Setfiles local policy
 #
 
+# dracut/initramfs: /dev/console
+dev_dontaudit_rw_generic_chr_files(setfiles_t)
+
 seutil_setfiles(setfiles_t)
 
 term_use_generic_ptys(setfiles_t)

index fa3a66f..d2b2060 100644
@@ -188,6 +188,25 @@ interface(`udev_dontaudit_search_db',`
 
 ########################################
 ## <summary>
+##	Delete udev device table files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`udev_delete_db_files',`
+	gen_require(`
+		type udev_tbl_t;
+	')
+
+	delete_files_pattern($1, udev_tbl_t, udev_tbl_t)
+	dev_list_all_dev_nodes($1)
+')
+
+########################################
+## <summary>
 ##	Read the udev device table.
 ## </summary>
 ## <param name="domain">