rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Add virt_content_ro_t and labeling for isos directory

Browse Source
This commit is contained in:
Daniel J Walsh 2009-01-30 14:24:45 +00:00
parent 618e35262f
commit 2528660492
1 changed files with 32 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
policy-20090105.patch
View File

@ -3686,7 +3686,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/qemu.te serefpolicy-3.6.3/policy/modules/apps/qemu.te
--- nsaserefpolicy/policy/modules/apps/qemu.te 2009-01-19 11:03:28.000000000 -0500
+++ serefpolicy-3.6.3/policy/modules/apps/qemu.te 2009-01-30 09:14:38.000000000 -0500
+++ serefpolicy-3.6.3/policy/modules/apps/qemu.te 2009-01-30 09:22:46.000000000 -0500
@@ -6,6 +6,8 @@
# Declarations
#
@ -3696,7 +3696,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## <desc>
## <p>
## Allow qemu to connect fully to the network
@@ -13,28 +15,153 @@
@@ -13,28 +15,154 @@
## </desc>
gen_tunable(qemu_full_network, false)
@ -3784,6 +3784,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+optional_policy(`
+ virt_read_config(qemutype)
+ virt_read_lib_files(qemutype)
+ virt_read_content(qemu_type)
+')
+
+optional_policy(`
@ -22390,21 +22391,21 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
optional_policy(`
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.fc serefpolicy-3.6.3/policy/modules/services/virt.fc
--- nsaserefpolicy/policy/modules/services/virt.fc 2009-01-05 15:39:43.000000000 -0500
+++ serefpolicy-3.6.3/policy/modules/services/virt.fc 2009-01-30 09:09:00.000000000 -0500
+++ serefpolicy-3.6.3/policy/modules/services/virt.fc 2009-01-30 09:23:34.000000000 -0500
@@ -8,5 +8,10 @@
/var/lib/libvirt(/.*)? gen_context(system_u:object_r:virt_var_lib_t,s0)
/var/lib/libvirt/images(/.*)? gen_context(system_u:object_r:virt_image_t,s0)
+/var/lib/libvirt/isos(/.*)? gen_context(system_u:object_r:virt_image_ro_t,s0)
+/var/lib/libvirt/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
+
/var/log/libvirt(/.*)? gen_context(system_u:object_r:virt_log_t,s0)
/var/run/libvirt(/.*)? gen_context(system_u:object_r:virt_var_run_t,s0)
+
+HOME_DIR/VirtualMachines(/.*)? gen_context(system_u:object_r:virt_image_t,s0)
+HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_image_ro_t,s0)
+HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t,s0)
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.if serefpolicy-3.6.3/policy/modules/services/virt.if
--- nsaserefpolicy/policy/modules/services/virt.if 2009-01-05 15:39:43.000000000 -0500
+++ serefpolicy-3.6.3/policy/modules/services/virt.if 2009-01-30 09:13:05.000000000 -0500
+++ serefpolicy-3.6.3/policy/modules/services/virt.if 2009-01-30 09:23:23.000000000 -0500
@@ -293,6 +293,41 @@
########################################
@ -22417,17 +22418,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+## </summary>
+## </param>
+#
+interface(`virt_read_ro_t',`
+interface(`virt_read_content',`
+ gen_require(`
+ type virt_image_ro_t;
+ type virt_content_t;
+ ')
+
+ virt_search_lib($1)
+ allow $1 virt_image_ro_t:dir list_dir_perms;
+ read_dirs_pattern($1, virt_image_ro_t, virt_image_ro_t)
+ read_files_pattern($1, virt_image_ro_t, virt_image_ro_t)
+ read_lnk_files_pattern($1, virt_image_ro_t, virt_image_ro_t)
+ rw_blk_files_pattern($1, virt_image_ro_t, virt_image_ro_t)
+ allow $1 virt_content_t:dir list_dir_perms;
+ read_dirs_pattern($1, virt_content_t, virt_content_t)
+ read_files_pattern($1, virt_content_t, virt_content_t)
+ read_lnk_files_pattern($1, virt_content_t, virt_content_t)
+ rw_blk_files_pattern($1, virt_content_t, virt_content_t)
+
+ tunable_policy(`virt_use_nfs',`
+ fs_read_nfs_dirs($1)
@ -22449,14 +22450,14 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
## </summary>
diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/services/virt.te serefpolicy-3.6.3/policy/modules/services/virt.te
--- nsaserefpolicy/policy/modules/services/virt.te 2009-01-19 11:06:49.000000000 -0500
+++ serefpolicy-3.6.3/policy/modules/services/virt.te 2009-01-30 09:10:13.000000000 -0500
+++ serefpolicy-3.6.3/policy/modules/services/virt.te 2009-01-30 09:24:00.000000000 -0500
@@ -32,6 +32,10 @@
type virt_image_t, virt_image_type; # customizable
virt_image(virt_image_t)
+# virt Image files
+type virt_image_ro_t;
+virt_image(virt_image_ro_t)
+type virt_content_t;
+virt_image(virt_content_t)
+
type virt_log_t;
logging_log_file(virt_log_t)
@ -22470,7 +22471,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
allow virtd_t self:process { getsched sigkill signal execmem };
allow virtd_t self:fifo_file rw_file_perms;
allow virtd_t self:unix_stream_socket create_stream_socket_perms;
@@ -96,7 +100,7 @@
@@ -69,6 +73,9 @@
manage_files_pattern(virtd_t, virt_image_type, virt_image_type)
+manage_dirs_pattern(virtd_t, virt_content_t, virt_content_t)
+manage_files_pattern(virtd_t, virt_content_t virt_content_t)
+
manage_dirs_pattern(virtd_t, virt_log_t, virt_log_t)
manage_files_pattern(virtd_t, virt_log_t, virt_log_t)
logging_log_filetrans(virtd_t, virt_log_t, { file dir })
@@ -96,7 +103,7 @@
corenet_tcp_sendrecv_generic_node(virtd_t)
corenet_tcp_sendrecv_all_ports(virtd_t)
corenet_tcp_bind_generic_node(virtd_t)
@ -22479,7 +22490,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
corenet_tcp_bind_vnc_port(virtd_t)
corenet_tcp_connect_vnc_port(virtd_t)
corenet_tcp_connect_soundd_port(virtd_t)
@@ -110,11 +114,13 @@
@@ -110,11 +117,13 @@
files_read_usr_files(virtd_t)
files_read_etc_files(virtd_t)
@ -22493,7 +22504,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
storage_raw_write_removable_device(virtd_t)
storage_raw_read_removable_device(virtd_t)
@@ -129,7 +135,10 @@
@@ -129,7 +138,11 @@
logging_send_syslog_msg(virtd_t)
@ -22501,10 +22512,11 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
+
userdom_read_all_users_state(virtd_t)
+userdom_dontaudit_list_admin_dir(virtd_t)
+userdom_search_user_home_content(virtd_t)
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(virtd_t)
@@ -173,16 +182,17 @@
@@ -173,16 +186,17 @@
iptables_domtrans(virtd_t)
')