add lockdev

refpolicy/Changelog

@@ -9,6 +9,7 @@
 	ddcprobe
 	fetchmail
 	irc
+	lockdev
 	logwatch (Dan Walsh)
 	openct
 	readahead

refpolicy/policy/modules/apps/lockdev.fc

@@ -0,0 +1,2 @@
+
+/usr/sbin/lockdev	--	gen_context(system_u:object_r:lockdev_exec_t,s0)

refpolicy/policy/modules/apps/lockdev.if

@@ -0,0 +1,81 @@
+## <summary>device locking policy for lockdev</summary>
+
+#######################################
+## <summary>
+##	The per user domain template for the lockdev module.
+## </summary>
+## <desc>
+##	<p>
+##	This template creates derived domains which are used
+##	for lockdev. A derived type is also created to protect
+##	the user's device locks.
+##	</p>
+##	<p>
+##	This template is invoked automatically for each user, and
+##	generally does not need to be invoked directly
+##	by policy writers.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+## </param>
+## <param name="user_domain">
+##	The type of the user domain.
+## </param>
+## <param name="user_role">
+##	The role associated with the user domain.
+## </param>
+#
+template(`lockdev_per_userdomain_template',`
+	gen_require(`
+		type lockdev_exec_t;
+	')
+
+	########################################
+	#
+	# Declarations
+	#
+
+	type $1_lockdev_t;
+	domain_type($1_lockdev_t)
+	domain_entry_file($1_lockdev_t,lockdev_exec_t)
+	role $3 types $1_lockdev_t;
+
+	type $1_lockdev_lock_t;
+	files_lock_file($1_lockdev_lock_t)
+
+	########################################
+	#
+	# Local policy
+	#
+
+	# Use capabilities.
+	allow $1_lockdev_t self:capability setgid;
+	allow $1_lockdev_t $2:process signull;
+
+	# Transition from the user domain to the derived domain.
+	domain_auto_trans($2, lockdev_exec_t, $1_lockdev_t)
+	allow $2 $1_lockdev_t:fd use;
+	allow $1_lockdev_t $2:fd use;
+	allow $1_lockdev_t $2:fifo_file rw_file_perms;
+	allow $1_lockdev_t $2:process sigchld;
+
+	allow $1_lockdev_t $1_lockdev_lock_t:file create_file_perms;
+	files_create_lock($1_lockdev_t,$1_lockdev_lock_t)
+
+	files_read_all_locks($1_lockdev_t)
+
+	fs_getattr_xattr_fs($1_lockdev_t)
+	
+	libs_use_ld_so($1_lockdev_t)
+	libs_use_shared_libs($1_lockdev_t)
+
+	logging_send_syslog_msg($1_lockdev_t)
+
+	userdom_use_user_terminals($1, $1_lockdev_t)
+	
+	optional_policy(`logging',`
+		logging_send_syslog_msg($1_t)
+	')
+')

refpolicy/policy/modules/apps/lockdev.te

@@ -0,0 +1,10 @@
+
+policy_module(lockdev,1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type lockdev_exec_t;
+files_type(lockdev_exec_t)

refpolicy/policy/modules/kernel/files.if

@@ -2879,6 +2879,26 @@ interface(`files_delete_all_locks',`
 	allow $1 lockfile:file { getattr unlink };
 ')
 
+########################################
+## <summary>
+##	Read all lock files.
+## </summary>
+## <param name="domain">
+##	Domain allowed access.
+## </param>
+#
+interface(`files_read_all_locks',`
+	gen_require(`
+		attribute lockfile;
+		type var_t, var_lock_t;
+	')
+
+	allow $1 { var_t var_lock_t }:dir search_dir_perms;
+	allow $1 lockfile:dir r_dir_perms;
+	allow $1 lockfile:file r_file_perms;
+	allow $1 lockfile:lnk_file { getattr read };
+')
+
 ########################################
 #
 # files_create_lock(domain,private_type,[object class(es)])
@@ -3257,4 +3277,4 @@ interface(`files_write_non_security_dir',`
 	')
 
 	allow $1 file_type:dir write;
-')
+')