[refpolicy] system_udev.patch

[refpolicy] system_udev.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F11/system_udev.patch

Add file context for /var/run/PackageKit/udev

Switch interfaces to use udev_tbl_t

udev can exec helper apps

Searches dbugfs

Reads software raid, sends audit messages

Reads also lib

Executes the clock

Reads devicekit pid file.

Executes lvm commands

Search rm log files

We run it unconfined on Fedora.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkmsX2oACgkQrlYvE4MpobNiUwCgwRX2BipvynvZr2pUtZvqvE5m
7P8An20CYCm/IzoEf3YBAWHTJnyyb4Nf
=pmiP
-----END PGP SIGNATURE-----

[refpolicy] system_udev.patch

[Christopher J. PeBenito]

On Mon, 2009-03-02 at 17:36 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F11/system_udev.patch
> 
> Add file context for /var/run/PackageKit/udev
> 
> Switch interfaces to use udev_tbl_t
> 
> udev can exec helper apps
> 
> Searches dbugfs
> 
> Reads software raid, sends audit messages
> 
> Reads also lib
> 
> Executes the clock
> 
> Reads devicekit pid file.
> 
> Executes lvm commands
> 
> Search rm log files
> 
> We run it unconfined on Fedora.

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] system_udev.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F11/system_udev.patch

NetworkManager is execing udevadm so needs udev_exec interface

[refpolicy] system_udev.patch

[Christopher J. PeBenito]

On Fri, 2009-03-20 at 13:00 -0400, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F11/system_udev.patch
> 
> NetworkManager is execing udevadm so needs udev_exec interface

Merged.  Moved unconfined to distro_redhat.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] system_udev.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F12/system_udev.patch

Fix udev labels.

[refpolicy] system_udev.patch

[Christopher J. PeBenito]

On Thu, 2009-11-12 at 17:16 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F12/system_udev.patch
> 
> Fix udev labels.

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] system_udev.patch

[Daniel J Walsh]

http://people.fedoraproject.org/~dwalsh/SELinux/F13/system_udev.patch

Allow other domains to unlink udev_tbl_t

Uses netlink sockets

Creates device_t symlinks

Reads consolekit_var_run

dontaudit leaks from hal

Searches rpm logs (probably a leak)

Transitions to usbmux_d

[refpolicy] system_udev.patch

[Christopher J. PeBenito]

On Tue, 2010-02-23 at 16:19 -0500, Daniel J Walsh wrote:
> http://people.fedoraproject.org/~dwalsh/SELinux/F13/system_udev.patch
> 
> Allow other domains to unlink udev_tbl_t

Needs a different interface, adding it to udev_rw_db() is an excessive
permission for the interface.

> Uses netlink sockets

Do you have any information on this?  It would be best to get a specific
class added for this socket, rather than use the generic netlink_socket.

Otherwise merged.

> Creates device_t symlinks
> 
> Reads consolekit_var_run
> 
> dontaudit leaks from hal
> 
> Searches rpm logs (probably a leak)
> 
> Transitions to usbmux_d
> 
> 
> 

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150

[refpolicy] system_udev.patch

[Daniel J Walsh]

On 03/17/2010 03:17 PM, Christopher J. PeBenito wrote:
> On Tue, 2010-02-23 at 16:19 -0500, Daniel J Walsh wrote:
>    
>> http://people.fedoraproject.org/~dwalsh/SELinux/F13/system_udev.patch
>>
>> Allow other domains to unlink udev_tbl_t
>>      
> Needs a different interface, adding it to udev_rw_db() is an excessive
> permission for the interface.
>
>    
>> Uses netlink sockets
>>      
> Do you have any information on this?  It would be best to get a specific
> class added for this socket, rather than use the generic netlink_socket.
>
>    
Added during F11.  Same time as netlink_kobj_uevent_socket.  Might be 
the same thing.
> Otherwise merged.
>
>    
>> Creates device_t symlinks
>>
>> Reads consolekit_var_run
>>
>> dontaudit leaks from hal
>>
>> Searches rpm logs (probably a leak)
>>
>> Transitions to usbmux_d
>>
>>
>>
>>      
>    
Updated patch including new policy for usbmuxd.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: udev.patch
Url: http://oss.tresys.com/pipermail/refpolicy/attachments/20100318/aa7f25a4/attachment.pl 

[refpolicy] system_udev.patch

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

http://people.fedoraproject.org/~dwalsh/SELinux/F14/system_udev.patch

tmpfs /var/run
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkx2/JAACgkQrlYvE4MpobPiSgCgq3NgMTLlIiUSqj8lJdtRtCf2
I4sAn3pIQhW9kWbaN4pFwNThXY6sIUPv
=5Udz
-----END PGP SIGNATURE-----