All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] Interface to read and write the mount_runtime_t directory.
@ 2019-01-15  3:20 Sugar, David
  2019-01-15  3:20 ` [PATCH 1/2] Interface with systemd_hostnamed over dbus to set hostname Sugar, David
                   ` (3 more replies)
  0 siblings, 4 replies; 10+ messages in thread
From: Sugar, David @ 2019-01-15  3:20 UTC (permalink / raw)
  To: selinux-refpolicy@vger.kernel.org

I see this denial when mounting media.  I'm running mount_exec_t
from my domain, not transitioning.

type=AVC msg=audit(1547086778.470:331): avc:  denied  { read write } for  pid=11172 comm="mount" name="mount" dev="tmpfs" ino=9470 scontext=sysadm_u:sysadm_r:settings_sudo_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_runtime_t:s0 tclass=dir permissive=1

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/system/mount.if | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/policy/modules/system/mount.if b/policy/modules/system/mount.if
index bf9a8bf3..31475bde 100644
--- a/policy/modules/system/mount.if
+++ b/policy/modules/system/mount.if
@@ -220,3 +220,21 @@ interface(`mount_rw_runtime_files',`
 	rw_files_pattern($1, mount_runtime_t, mount_runtime_t)
 ')
 
+########################################
+## <summary>
+##	Read and write mount runtime directory
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mount_rw_runtime_dir',`
+	gen_require(`
+		type mount_runtime_t;
+	')
+
+	allow $1 mount_runtime_t:dir rw_dir_perms;
+')
+
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 10+ messages in thread
* [PATCH] Add interface to create unit files with specified type via filetrans.
@ 2019-01-11 15:30 Sugar, David
  2019-01-11 15:30 ` [PATCH 1/2] Interface with systemd_hostnamed over dbus to set hostname Sugar, David
  0 siblings, 1 reply; 10+ messages in thread
From: Sugar, David @ 2019-01-11 15:30 UTC (permalink / raw)
  To: selinux-refpolicy@vger.kernel.org

This is adding an interface to perform a filetrans when creating
systemd unit files (in systemd_unit_t directory).  Something like this
is required if creating new unit files for systemd and you want them
to have something other than the generic systemd_unit_t type.

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/system/init.if | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 5beb21e9..caed4867 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -3040,6 +3040,40 @@ interface(`init_reload_all_units',`
 	allow $1 { init_script_file_type systemdunit }:service reload;
 ')
 
+########################################
+## <summary>
+##	Create systemd_unit_t objects with a private
+##	type using a type_transition.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="file_type">
+##	<summary>
+##	Private file type.
+##	</summary>
+## </param>
+## <param name="class">
+##	<summary>
+##	Object classes to be created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`init_unit_filetrans',`
+	gen_require(`
+		type systemd_unit_t;
+	')
+
+	filetrans_pattern($1, systemd_unit_t, $2, $3, $4)
+')
+
 ########################################
 ## <summary>
 ##      Allow unconfined access to send instructions to init
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2019-01-22 14:47 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-01-15  3:20 [PATCH] Interface to read and write the mount_runtime_t directory Sugar, David
2019-01-15  3:20 ` [PATCH 1/2] Interface with systemd_hostnamed over dbus to set hostname Sugar, David
2019-01-16 23:12   ` Chris PeBenito
2019-01-15  3:20 ` [PATCH 2/2 v2] Modify type for /etc/hostname Sugar, David
2019-01-16 23:13   ` Chris PeBenito
2019-01-15  3:20 ` [PATCH] label journald configuraiton files syslog_conf_t Sugar, David
2019-01-16 23:12   ` Chris PeBenito
2019-01-16 23:06 ` [PATCH] Interface to read and write the mount_runtime_t directory Chris PeBenito
2019-01-22 14:47   ` Sugar, David
  -- strict thread matches above, loose matches on Subject: below --
2019-01-11 15:30 [PATCH] Add interface to create unit files with specified type via filetrans Sugar, David
2019-01-11 15:30 ` [PATCH 1/2] Interface with systemd_hostnamed over dbus to set hostname Sugar, David

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.