From: Martin Orr <selinux@martinorr.name>
To: selinux@tycho.nsa.gov
Subject: alsactl policy
Date: Mon, 23 Jul 2007 20:49:47 +0100 [thread overview]
Message-ID: <46A5065B.8050709@martinorr.name> (raw)
[-- Attachment #1: Type: text/plain, Size: 260 bytes --]
The alsa policy doesn't address alsactl, run from an init script and via a
udev rule whenever a sound device is loaded to set volumes. This patch
addresses this. Since I have never written SELinux policy before, all
comments are appreciated.
--
Martin Orr
[-- Attachment #2: alsa.diff --]
[-- Type: text/plain, Size: 2458 bytes --]
Index: policy/modules/system/init.te
===================================================================
--- policy/modules/system/init.te (revision 2373)
+++ policy/modules/system/init.te (working copy)
@@ -541,6 +541,10 @@
')
optional_policy(`
+ alsa_domtrans(initrc_t)
+')
+
+optional_policy(`
amavis_search_lib(initrc_t)
amavis_setattr_pid_files(initrc_t)
')
Index: policy/modules/system/udev.te
===================================================================
--- policy/modules/system/udev.te (revision 2373)
+++ policy/modules/system/udev.te (working copy)
@@ -176,6 +176,10 @@
')
optional_policy(`
+ alsa_domtrans(udev_t)
+')
+
+optional_policy(`
consoletype_exec(udev_t)
')
Index: policy/modules/admin/alsa.te
===================================================================
--- policy/modules/admin/alsa.te (revision 2373)
+++ policy/modules/admin/alsa.te (working copy)
@@ -14,6 +14,9 @@
type alsa_etc_rw_t;
files_type(alsa_etc_rw_t)
+type alsa_var_lib_t;
+files_type(alsa_var_lib_t)
+
########################################
#
# Local policy
@@ -30,9 +33,20 @@
manage_lnk_files_pattern(alsa_t,alsa_etc_rw_t,alsa_etc_rw_t)
files_read_etc_files(alsa_t)
+files_read_usr_files(alsa_t)
+files_search_pids(alsa_t)
+# asound.state: lives in /var/lib/alsa on Debian, /etc elsewhere
+files_etc_filetrans(alsa_t,alsa_etc_rw_t,file)
+files_search_var_lib(alsa_t)
+manage_files_pattern(alsa_t,alsa_var_lib_t,alsa_var_lib_t)
+
+dev_read_sound(alsa_t)
+dev_write_sound(alsa_t)
+
term_use_generic_ptys(alsa_t)
term_dontaudit_use_unallocated_ttys(alsa_t)
+init_dontaudit_use_fds(alsa_t)
libs_use_ld_so(alsa_t)
libs_use_shared_libs(alsa_t)
@@ -43,6 +57,7 @@
userdom_manage_unpriv_user_semaphores(alsa_t)
userdom_manage_unpriv_user_shared_mem(alsa_t)
+userdom_search_generic_user_home_dirs(alsa_t)
optional_policy(`
nscd_socket_use(alsa_t)
Index: policy/modules/admin/alsa.fc
===================================================================
--- policy/modules/admin/alsa.fc (revision 2373)
+++ policy/modules/admin/alsa.fc (working copy)
@@ -1,4 +1,8 @@
/etc/alsa/pcm(/.*)? gen_context(system_u:object_r:alsa_etc_rw_t,s0)
+/etc/asound\.state -- gen_context(system_u:object_r:alsa_etc_rw_t,s0)
+/var/lib/alsa(/.*)? gen_context(system_u:object_r:alsa_var_lib_t,s0)
+
/usr/bin/ainit -- gen_context(system_u:object_r:alsa_exec_t,s0)
+/usr/sbin/alsactl -- gen_context(system_u:object_r:alsa_exec_t,s0)
next reply other threads:[~2007-07-24 12:25 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-07-23 19:49 Martin Orr [this message]
2007-07-27 13:11 ` alsactl policy Christopher J. PeBenito
-- strict thread matches above, loose matches on Subject: below --
2007-09-16 20:13 Martin Orr
2007-09-17 14:21 ` Daniel J Walsh
2007-09-18 15:03 ` Martin Orr
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=46A5065B.8050709@martinorr.name \
--to=selinux@martinorr.name \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.