add lockdev
This commit is contained in:
parent
7e0fa55f06
commit
1ae2c31350
@ -9,6 +9,7 @@
|
|||||||
ddcprobe
|
ddcprobe
|
||||||
fetchmail
|
fetchmail
|
||||||
irc
|
irc
|
||||||
|
lockdev
|
||||||
logwatch (Dan Walsh)
|
logwatch (Dan Walsh)
|
||||||
openct
|
openct
|
||||||
readahead
|
readahead
|
||||||
|
2
refpolicy/policy/modules/apps/lockdev.fc
Normal file
2
refpolicy/policy/modules/apps/lockdev.fc
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
|
||||||
|
/usr/sbin/lockdev -- gen_context(system_u:object_r:lockdev_exec_t,s0)
|
81
refpolicy/policy/modules/apps/lockdev.if
Normal file
81
refpolicy/policy/modules/apps/lockdev.if
Normal file
@ -0,0 +1,81 @@
|
|||||||
|
## <summary>device locking policy for lockdev</summary>
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
## <summary>
|
||||||
|
## The per user domain template for the lockdev module.
|
||||||
|
## </summary>
|
||||||
|
## <desc>
|
||||||
|
## <p>
|
||||||
|
## This template creates derived domains which are used
|
||||||
|
## for lockdev. A derived type is also created to protect
|
||||||
|
## the user's device locks.
|
||||||
|
## </p>
|
||||||
|
## <p>
|
||||||
|
## This template is invoked automatically for each user, and
|
||||||
|
## generally does not need to be invoked directly
|
||||||
|
## by policy writers.
|
||||||
|
## </p>
|
||||||
|
## </desc>
|
||||||
|
## <param name="userdomain_prefix">
|
||||||
|
## The prefix of the user domain (e.g., user
|
||||||
|
## is the prefix for user_t).
|
||||||
|
## </param>
|
||||||
|
## <param name="user_domain">
|
||||||
|
## The type of the user domain.
|
||||||
|
## </param>
|
||||||
|
## <param name="user_role">
|
||||||
|
## The role associated with the user domain.
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
template(`lockdev_per_userdomain_template',`
|
||||||
|
gen_require(`
|
||||||
|
type lockdev_exec_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Declarations
|
||||||
|
#
|
||||||
|
|
||||||
|
type $1_lockdev_t;
|
||||||
|
domain_type($1_lockdev_t)
|
||||||
|
domain_entry_file($1_lockdev_t,lockdev_exec_t)
|
||||||
|
role $3 types $1_lockdev_t;
|
||||||
|
|
||||||
|
type $1_lockdev_lock_t;
|
||||||
|
files_lock_file($1_lockdev_lock_t)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
# Use capabilities.
|
||||||
|
allow $1_lockdev_t self:capability setgid;
|
||||||
|
allow $1_lockdev_t $2:process signull;
|
||||||
|
|
||||||
|
# Transition from the user domain to the derived domain.
|
||||||
|
domain_auto_trans($2, lockdev_exec_t, $1_lockdev_t)
|
||||||
|
allow $2 $1_lockdev_t:fd use;
|
||||||
|
allow $1_lockdev_t $2:fd use;
|
||||||
|
allow $1_lockdev_t $2:fifo_file rw_file_perms;
|
||||||
|
allow $1_lockdev_t $2:process sigchld;
|
||||||
|
|
||||||
|
allow $1_lockdev_t $1_lockdev_lock_t:file create_file_perms;
|
||||||
|
files_create_lock($1_lockdev_t,$1_lockdev_lock_t)
|
||||||
|
|
||||||
|
files_read_all_locks($1_lockdev_t)
|
||||||
|
|
||||||
|
fs_getattr_xattr_fs($1_lockdev_t)
|
||||||
|
|
||||||
|
libs_use_ld_so($1_lockdev_t)
|
||||||
|
libs_use_shared_libs($1_lockdev_t)
|
||||||
|
|
||||||
|
logging_send_syslog_msg($1_lockdev_t)
|
||||||
|
|
||||||
|
userdom_use_user_terminals($1, $1_lockdev_t)
|
||||||
|
|
||||||
|
optional_policy(`logging',`
|
||||||
|
logging_send_syslog_msg($1_t)
|
||||||
|
')
|
||||||
|
')
|
10
refpolicy/policy/modules/apps/lockdev.te
Normal file
10
refpolicy/policy/modules/apps/lockdev.te
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
|
||||||
|
policy_module(lockdev,1.0.0)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Declarations
|
||||||
|
#
|
||||||
|
|
||||||
|
type lockdev_exec_t;
|
||||||
|
files_type(lockdev_exec_t)
|
@ -2879,6 +2879,26 @@ interface(`files_delete_all_locks',`
|
|||||||
allow $1 lockfile:file { getattr unlink };
|
allow $1 lockfile:file { getattr unlink };
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Read all lock files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## Domain allowed access.
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`files_read_all_locks',`
|
||||||
|
gen_require(`
|
||||||
|
attribute lockfile;
|
||||||
|
type var_t, var_lock_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 { var_t var_lock_t }:dir search_dir_perms;
|
||||||
|
allow $1 lockfile:dir r_dir_perms;
|
||||||
|
allow $1 lockfile:file r_file_perms;
|
||||||
|
allow $1 lockfile:lnk_file { getattr read };
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
#
|
#
|
||||||
# files_create_lock(domain,private_type,[object class(es)])
|
# files_create_lock(domain,private_type,[object class(es)])
|
||||||
|
Loading…
Reference in New Issue
Block a user