rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Storage patch from Dan Walsh.

Browse Source 
Add /dev/hwcdrom
This commit is contained in:
Chris PeBenito 2010-06-04 09:47:45 -04:00
parent 5c2b95e1b9
commit 8f0de5df68
3 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/kernel/storage.fc
View File

@ -20,6 +20,7 @@
/dev/gscd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/hitcd -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/ht[0-1] -b gen_context(system_u:object_r:tape_device_t,s0)
/dev/hwcdrom -b gen_context(system_u:object_r:removable_device_t,s0)
/dev/initrd -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/jsfd -b gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)
/dev/jsflash -c gen_context(system_u:object_r:fixed_disk_device_t,mls_systemhigh)

19
policy/modules/kernel/storage.if
View File

@ -570,6 +570,25 @@ interface(`storage_dontaudit_read_removable_device',`
dontaudit $1 removable_device_t:blk_file read_blk_file_perms;
')
########################################
## <summary>
## Do not audit attempts made by the caller to write
## removable devices device nodes.
## </summary>
## <param name="domain">
## <summary>
## The type of the process to not audit.
## </summary>
## </param>
#
interface(`storage_dontaudit_write_removable_device',`
gen_require(`
type removable_device_t;
')
dontaudit $1 removable_device_t:blk_file write_blk_file_perms;
')
########################################
## <summary>
## Allow the caller to set the attributes of removable

2
policy/modules/kernel/storage.te
View File

@ -1,5 +1,5 @@
policy_module(storage, 1.8.0)
policy_module(storage, 1.8.1)
########################################
#