* modutils policy patch
@ 2007-04-19 14:44 Daniel J Walsh
2007-05-02 17:29 ` Christopher J. PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Daniel J Walsh @ 2007-04-19 14:44 UTC (permalink / raw)
To: Christopher J. PeBenito, SE Linux
[-- Attachment #1: Type: text/plain, Size: 241 bytes --]
insmod needs to be able to mount kvmfs for kvm.
insmod executes init scripts when inserting and removing certain modules.
Any gui tool that is launched via userhelper can trigger a
unconfined_rw_pipe including ones that insert modules.
[-- Attachment #2: modutils.patch --]
[-- Type: text/x-patch, Size: 1428 bytes --]
--- nsaserefpolicy/policy/modules/system/modutils.te 2007-04-11 15:52:54.000000000 -0400
+++ serefpolicy-2.5.12/policy/modules/system/modutils.te 2007-04-17 15:50:53.000000000 -0400
@@ -58,6 +58,7 @@
kernel_read_system_state(insmod_t)
kernel_write_proc_files(insmod_t)
kernel_mount_debugfs(insmod_t)
+kernel_mount_kvmfs(insmod_t)
kernel_read_debugfs(insmod_t)
# Rules for /proc/sys/kernel/tainted
kernel_read_kernel_sysctls(insmod_t)
@@ -101,6 +102,7 @@
init_use_fds(insmod_t)
init_use_script_fds(insmod_t)
init_use_script_ptys(insmod_t)
+init_spec_domtrans_script(insmod_t)
libs_use_ld_so(insmod_t)
libs_use_shared_libs(insmod_t)
@@ -163,6 +165,10 @@
xserver_getattr_log(insmod_t)
')
+optional_policy(`
+ unconfined_dontaudit_rw_pipes(insmod_t)
+')
+
########################################
#
# depmod local policy
--- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-02-19 11:32:51.000000000 -0500
+++ serefpolicy-2.5.12/policy/modules/kernel/kernel.if 2007-04-17 15:50:55.000000000 -0400
@@ -2408,3 +2425,22 @@
typeattribute $1 kern_unconfined;
')
+
+########################################
+## <summary>
+## Mount a kernel vm filesystem.
+## </summary>
+## <param name="domain">
+## <summary>
+## The type of the domain mounting the filesystem.
+## </summary>
+## </param>
+#
+interface(`kernel_mount_kvmfs',`
+ gen_require(`
+ type kvmfs_t;
+ ')
+
+ allow $1 kvmfs_t:filesystem mount;
+')
+
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: modutils policy patch
2007-04-19 14:44 modutils policy patch Daniel J Walsh
@ 2007-05-02 17:29 ` Christopher J. PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Christopher J. PeBenito @ 2007-05-02 17:29 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Thu, 2007-04-19 at 10:44 -0400, Daniel J Walsh wrote:
> insmod needs to be able to mount kvmfs for kvm.
>
> insmod executes init scripts when inserting and removing certain
> modules.
>
> Any gui tool that is launched via userhelper can trigger a
> unconfined_rw_pipe including ones that insert modules.
Merged except for the init script part; thats a spec transition instead
of a auto (insmod is selinux-aware)?
>
>
>
>
>
> differences
> between files
> attachment
> (modutils.patch)
>
> --- nsaserefpolicy/policy/modules/system/modutils.te 2007-04-11 15:52:54.000000000 -0400
> +++ serefpolicy-2.5.12/policy/modules/system/modutils.te 2007-04-17 15:50:53.000000000 -0400
> @@ -58,6 +58,7 @@
> kernel_read_system_state(insmod_t)
> kernel_write_proc_files(insmod_t)
> kernel_mount_debugfs(insmod_t)
> +kernel_mount_kvmfs(insmod_t)
> kernel_read_debugfs(insmod_t)
> # Rules for /proc/sys/kernel/tainted
> kernel_read_kernel_sysctls(insmod_t)
> @@ -101,6 +102,7 @@
> init_use_fds(insmod_t)
> init_use_script_fds(insmod_t)
> init_use_script_ptys(insmod_t)
> +init_spec_domtrans_script(insmod_t)
>
> libs_use_ld_so(insmod_t)
> libs_use_shared_libs(insmod_t)
> @@ -163,6 +165,10 @@
> xserver_getattr_log(insmod_t)
> ')
>
> +optional_policy(`
> + unconfined_dontaudit_rw_pipes(insmod_t)
> +')
> +
> ########################################
> #
> # depmod local policy
> --- nsaserefpolicy/policy/modules/kernel/kernel.if 2007-02-19 11:32:51.000000000 -0500
> +++ serefpolicy-2.5.12/policy/modules/kernel/kernel.if 2007-04-17 15:50:55.000000000 -0400
> @@ -2408,3 +2425,22 @@
>
> typeattribute $1 kern_unconfined;
> ')
> +
> +########################################
> +## <summary>
> +## Mount a kernel vm filesystem.
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +## The type of the domain mounting the filesystem.
> +## </summary>
> +## </param>
> +#
> +interface(`kernel_mount_kvmfs',`
> + gen_require(`
> + type kvmfs_t;
> + ')
> +
> + allow $1 kvmfs_t:filesystem mount;
> +')
> +
>
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2007-05-02 17:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-04-19 14:44 modutils policy patch Daniel J Walsh
2007-05-02 17:29 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.