trunk: xen updates from dan

This commit is contained in:
Chris PeBenito 2007-06-21 13:36:05 +00:00
parent 92d1ade254
commit 7f089782ae
3 changed files with 66 additions and 3 deletions

View File

@ -1,3 +1,4 @@
- Xen updates from Dan Walsh.
- Filesystem updates from Dan Walsh. - Filesystem updates from Dan Walsh.
- Large samba update from Dan Walsh. - Large samba update from Dan Walsh.
- Drop snmpd_etc_t. - Drop snmpd_etc_t.

View File

@ -55,6 +55,25 @@ interface(`xen_dontaudit_use_fds',`
dontaudit $1 xend_t:fd use; dontaudit $1 xend_t:fd use;
') ')
########################################
## <summary>
## Read xend image files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`xen_read_image_files',`
gen_require(`
type xen_image_t, xend_var_lib_t;
')
files_list_var_lib($1)
read_files_pattern($1,{ xend_var_lib_t xen_image_t },xen_image_t)
')
######################################## ########################################
## <summary> ## <summary>
## Allow the specified domain to append ## Allow the specified domain to append
@ -72,10 +91,31 @@ interface(`xen_append_log',`
') ')
logging_search_logs($1) logging_search_logs($1)
allow $1 xend_var_log_t:file { getattr append }; append_files_pattern($1,xend_var_log_t,xend_var_log_t)
dontaudit $1 xend_var_log_t:file write; dontaudit $1 xend_var_log_t:file write;
') ')
########################################
## <summary>
## Create, read, write, and delete the
## xend log files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`xen_manage_log',`
gen_require(`
type var_log_t, xend_var_log_t;
')
logging_search_logs($1)
manage_dirs_pattern($1,xend_var_log_t,xend_var_log_t)
manage_files_pattern($1,xend_var_log_t,xend_var_log_t)
')
######################################## ########################################
## <summary> ## <summary>
## Do not audit attempts to read and write ## Do not audit attempts to read and write

View File

@ -1,5 +1,5 @@
policy_module(xen,1.3.0) policy_module(xen,1.3.1)
######################################## ########################################
# #
@ -25,6 +25,10 @@ type xend_exec_t;
domain_type(xend_t) domain_type(xend_t)
init_daemon_domain(xend_t, xend_exec_t) init_daemon_domain(xend_t, xend_exec_t)
# tmp files
type xend_tmp_t;
files_tmp_file(xend_tmp_t)
# var/lib files # var/lib files
type xend_var_lib_t; type xend_var_lib_t;
files_type(xend_var_lib_t) files_type(xend_var_lib_t)
@ -88,16 +92,22 @@ allow xend_t self:packet_socket create_socket_perms;
allow xend_t xen_image_t:dir list_dir_perms; allow xend_t xen_image_t:dir list_dir_perms;
manage_dirs_pattern(xend_t,xen_image_t,xen_image_t) manage_dirs_pattern(xend_t,xen_image_t,xen_image_t)
manage_files_pattern(xend_t,xen_image_t,xen_image_t) manage_files_pattern(xend_t,xen_image_t,xen_image_t)
read_lnk_files_pattern(xend_t,xen_image_t,xen_image_t)
rw_blk_files_pattern(xend_t,xen_image_t,xen_image_t) rw_blk_files_pattern(xend_t,xen_image_t,xen_image_t)
allow xend_t xenctl_t:fifo_file manage_file_perms; allow xend_t xenctl_t:fifo_file manage_file_perms;
dev_filetrans(xend_t, xenctl_t, fifo_file) dev_filetrans(xend_t, xenctl_t, fifo_file)
manage_files_pattern(xend_t,xend_tmp_t,xend_tmp_t)
manage_dirs_pattern(xend_t,xend_tmp_t,xend_tmp_t)
files_tmp_filetrans(xend_t, xend_tmp_t, { file dir })
# pid file # pid file
allow xend_t xend_var_run_t:dir setattr; allow xend_t xend_var_run_t:dir setattr;
manage_files_pattern(xend_t,xend_var_run_t,xend_var_run_t) manage_files_pattern(xend_t,xend_var_run_t,xend_var_run_t)
manage_sock_files_pattern(xend_t,xend_var_run_t,xend_var_run_t) manage_sock_files_pattern(xend_t,xend_var_run_t,xend_var_run_t)
files_pid_filetrans(xend_t,xend_var_run_t, { file sock_file }) manage_fifo_files_pattern(xend_t,xend_var_run_t,xend_var_run_t)
files_pid_filetrans(xend_t,xend_var_run_t, { file sock_file fifo_file })
# log files # log files
allow xend_t xend_var_log_t:dir setattr; allow xend_t xend_var_log_t:dir setattr;
@ -167,6 +177,7 @@ files_etc_filetrans_etc_runtime(xend_t,file)
files_read_usr_files(xend_t) files_read_usr_files(xend_t)
storage_raw_read_fixed_disk(xend_t) storage_raw_read_fixed_disk(xend_t)
storage_raw_write_fixed_disk(xend_t)
storage_raw_read_removable_device(xend_t) storage_raw_read_removable_device(xend_t)
term_getattr_all_user_ptys(xend_t) term_getattr_all_user_ptys(xend_t)
@ -181,8 +192,12 @@ locallogin_dontaudit_use_fds(xend_t)
logging_send_syslog_msg(xend_t) logging_send_syslog_msg(xend_t)
lvm_domtrans(xend_t)
miscfiles_read_localization(xend_t) miscfiles_read_localization(xend_t)
mount_domtrans(xend_t)
sysnet_domtrans_dhcpc(xend_t) sysnet_domtrans_dhcpc(xend_t)
sysnet_signal_dhcpc(xend_t) sysnet_signal_dhcpc(xend_t)
sysnet_domtrans_ifconfig(xend_t) sysnet_domtrans_ifconfig(xend_t)
@ -284,6 +299,10 @@ dev_read_sysfs(xenstored_t)
files_read_usr_files(xenstored_t) files_read_usr_files(xenstored_t)
storage_raw_read_fixed_disk(xenstored_t)
storage_raw_write_fixed_disk(xenstored_t)
storage_raw_read_removable_device(xenstored_t)
term_use_generic_ptys(xenstored_t) term_use_generic_ptys(xenstored_t)
term_use_console(xenconsoled_t) term_use_console(xenconsoled_t)
@ -317,6 +336,7 @@ files_search_var_lib(xm_t)
allow xm_t xen_image_t:dir rw_dir_perms; allow xm_t xen_image_t:dir rw_dir_perms;
allow xm_t xen_image_t:file read_file_perms; allow xm_t xen_image_t:file read_file_perms;
allow xm_t xen_image_t:blk_file read_blk_file_perms;
kernel_read_system_state(xm_t) kernel_read_system_state(xm_t)
kernel_read_kernel_sysctls(xm_t) kernel_read_kernel_sysctls(xm_t)
@ -337,6 +357,8 @@ files_list_mnt(xm_t)
# Some common macros (you might be able to remove some) # Some common macros (you might be able to remove some)
files_read_etc_files(xm_t) files_read_etc_files(xm_t)
storage_raw_read_fixed_disk(xm_t)
term_use_all_terms(xm_t) term_use_all_terms(xm_t)
init_rw_script_stream_sockets(xm_t) init_rw_script_stream_sockets(xm_t)