refpolicy: system_fstools changes]
PATCH 1/1 refpolicy: system_fstools changes]
Do not want to confine mkswap
postfix wants to read fsdaemon pipes
fsadm tools can be executed by users
fsadm needs to interact with xen
policy/modules/system/fstools.fc +0 -0
@@ -20,7 +20,6 @@
/sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0)/sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0)/sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0)
-/sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0)/sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0)/sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0)/sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)
policy/modules/system/fstools.if +0 -0
@@ -124,3 +124,22 @@
allow $1 swapfile_t:file getattr;
')
+
+########################################
+## <summary>
+## Read fstools unnamed pipes.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(fstools_read_pipes',
+ gen_require(`
+ type fsdaemon_t;
+ ')
+
+ allow $1 fsdaemon_t:fifo_file read_fifo_file_perms;
+')
+
policy/modules/system/fstools.te +0 -0
@@ -9,6 +9,7 @@
type fsadm_t;
type fsadm_exec_t;init_system_domain(fsadm_t,fsadm_exec_t)
+application_executable_file(fsadm_exec_t)
role system_r types fsadm_t;
type fsadm_log_t;
@@ -69,6 +70,7 @@
dev_getattr_all_chr_files(fsadm_t)dev_dontaudit_getattr_all_blk_files(fsadm_t)
+dev_dontaudit_getattr_generic_files(fsadm_t)
# mkreiserfs and other programs need this for UUID dev_read_rand(fsadm_t) dev_read_urand(fsadm_t) @@ -179,3 +181,8 @@ fs_dontaudit_write_ramfs_pipes(fsadm_t) rhgb_stub(fsadm_t) ') + +optional_policy(` + xen_append_log(fsadm_t) + xen_rw_image_files(fsadm_t) +')
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 2 lines · Daniel J Walsh
Do not want to confine mkswap
This part cannot be applied. You won't be able to format swap partitions. For any other use, thats why its attributed as an app, and exec() interfaces exist.
Quoted 1 line
postfix wants to read fsdaemon pipes
Merged.
Quoted 1 line
fsadm tools can be executed by users
Redundant due to init_system_domain()
Quoted 1 line
fsadm needs to interact with xen
I can't find the implementation for this interface.
Quoted 65 lines
policy/modules/system/fstools.fc 2007-08-02 11:02:02.000000000 -0400 renamed from policy/modules/system/fstools.fc 2007-06-11 16:05:30.000000000 -0400 +0
-1@@ -20,7 +20,6 @@ /sbin/mkfs.* -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkraid -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/mkreiserfs -- gen_context(system_u:object_r:fsadm_exec_t,s0) -/sbin/mkswap -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/parted -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partprobe -- gen_context(system_u:object_r:fsadm_exec_t,s0) /sbin/partx -- gen_context(system_u:object_r:fsadm_exec_t,s0)policy/modules/system/fstools.if 2007-08-02 11:02:02.000000000 -0400 renamed from policy/modules/system/fstools.if 2007-05-29 14:10:58.000000000 -0400 +19
-0@@ -124,3 +124,22 @@ allow $1 swapfile_t:file getattr; ') + +######################################## +## <summary> +## Read fstools unnamed pipes. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`fstools_read_pipes',` + gen_require(` + type fsdaemon_t; + ') + + allow $1 fsdaemon_t:fifo_file read_fifo_file_perms; +') +policy/modules/system/fstools.te 2007-08-02 11:02:02.000000000 -0400 renamed from policy/modules/system/fstools.te 2007-07-25 10:37:42.000000000 -0400 +7
-0@@ -9,6 +9,7 @@ type fsadm_t; type fsadm_exec_t; init_system_domain(fsadm_t,fsadm_exec_t) +application_executable_file(fsadm_exec_t) role system_r types fsadm_t; type fsadm_log_t;@@ -69,6 +70,7 @@ dev_getattr_all_chr_files(fsadm_t) dev_dontaudit_getattr_all_blk_files(fsadm_t) +dev_dontaudit_getattr_generic_files(fsadm_t) # mkreiserfs and other programs need this for UUID dev_read_rand(fsadm_t) dev_read_urand(fsadm_t)@@ -179,3 +181,8 @@ fs_dontaudit_write_ramfs_pipes(fsadm_t) rhgb_stub(fsadm_t) ') + +optional_policy(` + xen_append_log(fsadm_t) + xen_rw_image_files(fsadm_t) +')
Signature · 9 lines
Chris PeBenito Tresys Technology, LLC (410) 290-1411 x150 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.