[refpolicy] [PATCH] Intel® Active Management Technology

[refpolicy] [PATCH] Intel® Active Management Technology

[Dominick Grift]

Intel? AMT Linux support includes two components that allow interaction
between the Intel? AMT FW and the Linux OS: Intel? MEI (Intel? Management Engine Interface)
driver and LMS (Local Management Service) driver. Intel? MEI driver
allows application to communicate with the FW using host interface,
and LMS driver allows applications to access the Intel? AMT FW via the
local Intel? Management Engine Interface (Intel? MEI).

In addition, Intel has validated a kernel patch to enable
IDE-redirection. This is a community maintained patch, but Intel is
distributing the version used in the validation of the other Intel? AMT
components released here:

http://software.intel.com/en-us/articles/download-the-latest-intel-amt-open-source-drivers/

Declare a mei_device_t device node tyoe and label /dev/mei accordingly.

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index 06a0e93..84e7337 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -59,6 +59,7 @@
 /dev/logibm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/lp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
 /dev/mcelog		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
+/dev/mei		-c	gen_context(system_u:object_r:mei_device_t,s0)
 /dev/mem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
 /dev/mergemem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
 /dev/mga_vid.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index 9d4f26c..d7d5091 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -121,6 +121,9 @@
 type lvm_control_t;
 dev_node(lvm_control_t)
 
+type mei_device_t;
+dev_node(mei_device_t)
+
 #
 # memory_device_t is the type of /dev/kmem,
 # /dev/mem and /dev/port.

[refpolicy] [PATCH] Intel® Active Management Technology

[Christopher J. PeBenito]

On 08/22/12 09:21, Dominick Grift wrote:
> Intel?? AMT Linux support includes two components that allow interaction
> between the Intel?? AMT FW and the Linux OS: Intel?? MEI (Intel?? Management Engine Interface)
> driver and LMS (Local Management Service) driver. Intel?? MEI driver
> allows application to communicate with the FW using host interface,
> and LMS driver allows applications to access the Intel?? AMT FW via the
> local Intel?? Management Engine Interface (Intel?? MEI).
> 
> In addition, Intel has validated a kernel patch to enable
> IDE-redirection. This is a community maintained patch, but Intel is
> distributing the version used in the validation of the other Intel?? AMT
> components released here:
> 
> http://software.intel.com/en-us/articles/download-the-latest-intel-amt-open-source-drivers/
> 
> Declare a mei_device_t device node tyoe and label /dev/mei accordingly.
> 
> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
> index 06a0e93..84e7337 100644
> --- a/policy/modules/kernel/devices.fc
> +++ b/policy/modules/kernel/devices.fc
> @@ -59,6 +59,7 @@
>  /dev/logibm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
>  /dev/lp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
>  /dev/mcelog		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
> +/dev/mei		-c	gen_context(system_u:object_r:mei_device_t,s0)
>  /dev/mem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
>  /dev/mergemem		-c	gen_context(system_u:object_r:memory_device_t,mls_systemhigh)
>  /dev/mga_vid.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
> diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
> index 9d4f26c..d7d5091 100644
> --- a/policy/modules/kernel/devices.te
> +++ b/policy/modules/kernel/devices.te
> @@ -121,6 +121,9 @@
>  type lvm_control_t;
>  dev_node(lvm_control_t)
>  
> +type mei_device_t;
> +dev_node(mei_device_t)
> +
>  #
>  # memory_device_t is the type of /dev/kmem,
>  # /dev/mem and /dev/port.

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com