* Wed Nov 16 2016 Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-226

- Adding policy for tlp
- Add interface  dev_manage_sysfs()
- Allow ifconfig domain to manage tlp pid files.

policy-rawhide-base.patch

@@ -6601,7 +6601,7 @@ index b31c054..1ed65a0 100644
 +/usr/lib/udev/devices/null	-c	gen_context(system_u:object_r:null_device_t,s0)
 +/usr/lib/udev/devices/zero	-c	gen_context(system_u:object_r:zero_device_t,s0)
 diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
-index 76f285e..6843613 100644
+index 76f285e..72f99c0 100644
 --- a/policy/modules/kernel/devices.if
 +++ b/policy/modules/kernel/devices.if
 @@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',`
@@ -8048,7 +8048,7 @@ index 76f285e..6843613 100644
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4024,17 +4722,243 @@ interface(`dev_rw_sysfs',`
+@@ -4024,17 +4722,262 @@ interface(`dev_rw_sysfs',`
  ##	</summary>
  ## </param>
  #
@@ -8274,6 +8274,25 @@ index 76f285e..6843613 100644
 +
 +########################################
 +## <summary>
++##	Allow caller to modify hardware state information.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_manage_sysfs',`
++	gen_require(`
++		type sysfs_t;
++	')
++
++	manage_dirs_pattern($1, sysfs_t, sysfs_t)
++	manage_files_pattern($1, sysfs_t, sysfs_t)
++')
++
++########################################
++## <summary>
 +##	Read and write the TPM device.
 +## </summary>
 +## <param name="domain">
@@ -8296,7 +8315,7 @@ index 76f285e..6843613 100644
  ## </summary>
  ## <desc>
  ##	<p>
-@@ -4113,6 +5037,25 @@ interface(`dev_write_urand',`
+@@ -4113,6 +5056,25 @@ interface(`dev_write_urand',`
  
  ########################################
  ## <summary>
@@ -8322,7 +8341,7 @@ index 76f285e..6843613 100644
  ##	Getattr generic the USB devices.
  ## </summary>
  ## <param name="domain">
-@@ -4123,7 +5066,7 @@ interface(`dev_write_urand',`
+@@ -4123,7 +5085,7 @@ interface(`dev_write_urand',`
  #
  interface(`dev_getattr_generic_usb_dev',`
  	gen_require(`
@@ -8331,84 +8350,264 @@ index 76f285e..6843613 100644
  	')
  
  	getattr_chr_files_pattern($1, device_t, usb_device_t)
-@@ -4409,9 +5352,9 @@ interface(`dev_rw_usbfs',`
- 	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
- ')
+@@ -4330,28 +5292,180 @@ interface(`dev_search_usbfs',`
  
--########################################
-+######################################
+ ########################################
  ## <summary>
--##	Get the attributes of video4linux devices.
+-##	Allow caller to get a list of usb hardware.
++##	Allow caller to get a list of usb hardware.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_list_usbfs',`
++	gen_require(`
++		type usbfs_t;
++	')
++
++	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
++	getattr_files_pattern($1, usbfs_t, usbfs_t)
++
++	list_dirs_pattern($1, usbfs_t, usbfs_t)
++')
++
++########################################
++## <summary>
++##	Set the attributes of usbfs filesystem.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_setattr_usbfs_files',`
++	gen_require(`
++		type usbfs_t;
++	')
++
++	setattr_files_pattern($1, usbfs_t, usbfs_t)
++	list_dirs_pattern($1, usbfs_t, usbfs_t)
++')
++
++########################################
++## <summary>
++##	Read USB hardware information using
++##	the usbfs filesystem interface.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_read_usbfs',`
++	gen_require(`
++		type usbfs_t;
++	')
++
++	read_files_pattern($1, usbfs_t, usbfs_t)
++	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
++	list_dirs_pattern($1, usbfs_t, usbfs_t)
++')
++
++########################################
++## <summary>
++##	Allow caller to modify usb hardware configuration files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_rw_usbfs',`
++	gen_require(`
++		type usbfs_t;
++	')
++
++	list_dirs_pattern($1, usbfs_t, usbfs_t)
++	rw_files_pattern($1, usbfs_t, usbfs_t)
++	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
++')
++
++######################################
++## <summary>
 +##	Read and write userio device.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_rw_userio_dev',`
++	gen_require(`
++		type device_t, userio_device_t;
++	')
++
++	rw_chr_files_pattern($1, device_t, userio_device_t)
++')
++
++########################################
++## <summary>
++##	Get the attributes of video4linux devices.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_getattr_video_dev',`
++	gen_require(`
++		type device_t, v4l_device_t;
++	')
++
++	getattr_chr_files_pattern($1, device_t, v4l_device_t)
++')
++
++########################################
++## <summary>
++##	Do not audit attempts to get the attributes
++##	of video4linux device nodes.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain to not audit.
++##	</summary>
++## </param>
++#
++interface(`dev_dontaudit_getattr_video_dev',`
++	gen_require(`
++		type v4l_device_t;
++	')
++
++	dontaudit $1 v4l_device_t:chr_file getattr;
++')
++
++########################################
++## <summary>
++##	Set the attributes of video4linux device nodes.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`dev_setattr_video_dev',`
++	gen_require(`
++		type device_t, v4l_device_t;
++	')
++
++	setattr_chr_files_pattern($1, device_t, v4l_device_t)
++')
++
++########################################
++## <summary>
++##	Do not audit attempts to set the attributes
++##	of video4linux device nodes.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4419,17 +5362,17 @@ interface(`dev_rw_usbfs',`
+-##	Domain allowed access.
++##	Domain to not audit.
  ##	</summary>
  ## </param>
  #
--interface(`dev_getattr_video_dev',`
-+interface(`dev_rw_userio_dev',`
+-interface(`dev_list_usbfs',`
++interface(`dev_dontaudit_setattr_video_dev',`
  	gen_require(`
--		type device_t, v4l_device_t;
-+		type device_t, userio_device_t;
+-		type usbfs_t;
++		type v4l_device_t;
  	')
  
--	getattr_chr_files_pattern($1, device_t, v4l_device_t)
-+	rw_chr_files_pattern($1, device_t, userio_device_t)
+-	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
+-	getattr_files_pattern($1, usbfs_t, usbfs_t)
+-
+-	list_dirs_pattern($1, usbfs_t, usbfs_t)
++	dontaudit $1 v4l_device_t:chr_file setattr;
  ')
  
--######################################
-+########################################
+ ########################################
  ## <summary>
--##	Read and write userio device.
-+##	Get the attributes of video4linux devices.
+-##	Set the attributes of usbfs filesystem.
++##	Read the video4linux devices.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4437,12 +5380,12 @@ interface(`dev_getattr_video_dev',`
+@@ -4359,19 +5473,17 @@ interface(`dev_list_usbfs',`
  ##	</summary>
  ## </param>
  #
--interface(`dev_rw_userio_dev',`
-+interface(`dev_getattr_video_dev',`
+-interface(`dev_setattr_usbfs_files',`
++interface(`dev_read_video_dev',`
  	gen_require(`
--		type device_t, userio_device_t;
+-		type usbfs_t;
 +		type device_t, v4l_device_t;
  	')
  
--	rw_chr_files_pattern($1, device_t, userio_device_t)
-+	getattr_chr_files_pattern($1, device_t, v4l_device_t)
+-	setattr_files_pattern($1, usbfs_t, usbfs_t)
+-	list_dirs_pattern($1, usbfs_t, usbfs_t)
++	read_chr_files_pattern($1, device_t, v4l_device_t)
  ')
  
  ########################################
-@@ -4539,7 +5482,7 @@ interface(`dev_write_video_dev',`
+ ## <summary>
+-##	Read USB hardware information using
+-##	the usbfs filesystem interface.
++##	Write the video4linux devices.
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -4379,19 +5491,17 @@ interface(`dev_setattr_usbfs_files',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`dev_read_usbfs',`
++interface(`dev_write_video_dev',`
+ 	gen_require(`
+-		type usbfs_t;
++		type device_t, v4l_device_t;
+ 	')
+ 
+-	read_files_pattern($1, usbfs_t, usbfs_t)
+-	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
+-	list_dirs_pattern($1, usbfs_t, usbfs_t)
++	write_chr_files_pattern($1, device_t, v4l_device_t)
+ ')
  
  ########################################
  ## <summary>
--##	Allow read/write the vhost net device
+-##	Allow caller to modify usb hardware configuration files.
 +##	Get the attributes of vfio devices.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4547,35 +5490,36 @@ interface(`dev_write_video_dev',`
+@@ -4399,37 +5509,36 @@ interface(`dev_read_usbfs',`
  ##	</summary>
  ## </param>
  #
--interface(`dev_rw_vhost',`
+-interface(`dev_rw_usbfs',`
 +interface(`dev_getattr_vfio_dev',`
  	gen_require(`
--		type device_t, vhost_device_t;
+-		type usbfs_t;
 +		type device_t, vfio_device_t;
  	')
  
--	rw_chr_files_pattern($1, device_t, vhost_device_t)
+-	list_dirs_pattern($1, usbfs_t, usbfs_t)
+-	rw_files_pattern($1, usbfs_t, usbfs_t)
+-	read_lnk_files_pattern($1, usbfs_t, usbfs_t)
 +	getattr_chr_files_pattern($1, device_t, vfio_device_t)
  ')
  
  ########################################
  ## <summary>
--##	Read and write VMWare devices.
+-##	Get the attributes of video4linux devices.
 +##	Do not audit attempts to get the attributes
 +##	of vfio device nodes.
  ## </summary>
@@ -8419,186 +8618,177 @@ index 76f285e..6843613 100644
  ##	</summary>
  ## </param>
  #
--interface(`dev_rw_vmware',`
+-interface(`dev_getattr_video_dev',`
 +interface(`dev_dontaudit_getattr_vfio_dev',`
  	gen_require(`
--		type device_t, vmware_device_t;
+-		type device_t, v4l_device_t;
 +		type vfio_device_t;
  	')
  
--	rw_chr_files_pattern($1, device_t, vmware_device_t)
+-	getattr_chr_files_pattern($1, device_t, v4l_device_t)
 +	dontaudit $1 vfio_device_t:chr_file getattr;
  ')
  
- ########################################
+-######################################
++########################################
  ## <summary>
--##	Read, write, and mmap VMWare devices.
+-##	Read and write userio device.
 +##	Set the attributes of vfio device nodes.
  ## </summary>
  ## <param name="domain">
  ##	<summary>
-@@ -4583,12 +5527,157 @@ interface(`dev_rw_vmware',`
+@@ -4437,18 +5546,18 @@ interface(`dev_getattr_video_dev',`
  ##	</summary>
  ## </param>
  #
--interface(`dev_rwx_vmware',`
+-interface(`dev_rw_userio_dev',`
 +interface(`dev_setattr_vfio_dev',`
  	gen_require(`
--		type device_t, vmware_device_t;
+-		type device_t, userio_device_t;
 +		type device_t, vfio_device_t;
  	')
  
--	dev_rw_vmware($1)
+-	rw_chr_files_pattern($1, device_t, userio_device_t)
 +	setattr_chr_files_pattern($1, device_t, vfio_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Do not audit attempts to set the attributes
-+##	of vfio device nodes.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain to not audit.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_dontaudit_setattr_vfio_dev',`
-+	gen_require(`
-+		type vfio_device_t;
-+	')
-+
-+	dontaudit $1 vfio_device_t:chr_file setattr;
-+')
-+
-+########################################
-+## <summary>
-+##	Read the vfio devices.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_read_vfio_dev',`
-+	gen_require(`
-+		type device_t, vfio_device_t;
-+	')
-+
-+	read_chr_files_pattern($1, device_t, vfio_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Write the vfio devices.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_write_vfio_dev',`
-+	gen_require(`
-+		type device_t, vfio_device_t;
-+	')
-+
-+	write_chr_files_pattern($1, device_t, vfio_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Read and write the VFIO devices.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_rw_vfio_dev',`
-+	gen_require(`
-+		type device_t, vfio_device_t;
-+	')
-+
-+	rw_chr_files_pattern($1, device_t, vfio_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Allow read/write the vhost net device
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_rw_vhost',`
-+	gen_require(`
-+		type device_t, vhost_device_t;
-+	')
-+
-+	rw_chr_files_pattern($1, device_t, vhost_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Allow read/write inheretid the vhost net device
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_rw_inherited_vhost',`
-+	gen_require(`
-+		type device_t, vhost_device_t;
-+	')
-+
-+	allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms;
-+')
-+
-+########################################
-+## <summary>
-+##	Read and write VMWare devices.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_rw_vmware',`
-+	gen_require(`
-+		type device_t, vmware_device_t;
-+	')
-+
-+	rw_chr_files_pattern($1, device_t, vmware_device_t)
-+')
-+
-+########################################
-+## <summary>
-+##	Read, write, and mmap VMWare devices.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`dev_rwx_vmware',`
-+	gen_require(`
-+		type device_t, vmware_device_t;
-+	')
-+
-+	dev_rw_vmware($1)
- 	allow $1 vmware_device_t:chr_file execute;
  ')
  
-@@ -4630,6 +5719,24 @@ interface(`dev_write_watchdog',`
+ ########################################
+ ## <summary>
+-##	Do not audit attempts to get the attributes
+-##	of video4linux device nodes.
++##	Do not audit attempts to set the attributes
++##	of vfio device nodes.
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -4456,17 +5565,17 @@ interface(`dev_rw_userio_dev',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`dev_dontaudit_getattr_video_dev',`
++interface(`dev_dontaudit_setattr_vfio_dev',`
+ 	gen_require(`
+-		type v4l_device_t;
++		type vfio_device_t;
+ 	')
+ 
+-	dontaudit $1 v4l_device_t:chr_file getattr;
++	dontaudit $1 vfio_device_t:chr_file setattr;
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Set the attributes of video4linux device nodes.
++##	Read the vfio devices.
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -4474,36 +5583,35 @@ interface(`dev_dontaudit_getattr_video_dev',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`dev_setattr_video_dev',`
++interface(`dev_read_vfio_dev',`
+ 	gen_require(`
+-		type device_t, v4l_device_t;
++		type device_t, vfio_device_t;
+ 	')
+ 
+-	setattr_chr_files_pattern($1, device_t, v4l_device_t)
++	read_chr_files_pattern($1, device_t, vfio_device_t)
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Do not audit attempts to set the attributes
+-##	of video4linux device nodes.
++##	Write the vfio devices.
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+-##	Domain to not audit.
++##	Domain allowed access.
+ ##	</summary>
+ ## </param>
+ #
+-interface(`dev_dontaudit_setattr_video_dev',`
++interface(`dev_write_vfio_dev',`
+ 	gen_require(`
+-		type v4l_device_t;
++		type device_t, vfio_device_t;
+ 	')
+ 
+-	dontaudit $1 v4l_device_t:chr_file setattr;
++	write_chr_files_pattern($1, device_t, vfio_device_t)
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Read the video4linux devices.
++##	Read and write the VFIO devices.
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -4511,17 +5619,17 @@ interface(`dev_dontaudit_setattr_video_dev',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`dev_read_video_dev',`
++interface(`dev_rw_vfio_dev',`
+ 	gen_require(`
+-		type device_t, v4l_device_t;
++		type device_t, vfio_device_t;
+ 	')
+ 
+-	read_chr_files_pattern($1, device_t, v4l_device_t)
++	rw_chr_files_pattern($1, device_t, vfio_device_t)
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Write the video4linux devices.
++##	Allow read/write the vhost net device
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -4529,17 +5637,17 @@ interface(`dev_read_video_dev',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`dev_write_video_dev',`
++interface(`dev_rw_vhost',`
+ 	gen_require(`
+-		type device_t, v4l_device_t;
++		type device_t, vhost_device_t;
+ 	')
+ 
+-	write_chr_files_pattern($1, device_t, v4l_device_t)
++	rw_chr_files_pattern($1, device_t, vhost_device_t)
+ ')
+ 
+ ########################################
+ ## <summary>
+-##	Allow read/write the vhost net device
++##	Allow read/write inheretid the vhost net device
+ ## </summary>
+ ## <param name="domain">
+ ##	<summary>
+@@ -4547,12 +5655,12 @@ interface(`dev_write_video_dev',`
+ ##	</summary>
+ ## </param>
+ #
+-interface(`dev_rw_vhost',`
++interface(`dev_rw_inherited_vhost',`
+ 	gen_require(`
+ 		type device_t, vhost_device_t;
+ 	')
+ 
+-	rw_chr_files_pattern($1, device_t, vhost_device_t)
++	allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms;
+ ')
+ 
+ ########################################
+@@ -4630,6 +5738,24 @@ interface(`dev_write_watchdog',`
  
  ########################################
  ## <summary>
@@ -8623,7 +8813,7 @@ index 76f285e..6843613 100644
  ##	Read and write the the wireless device.
  ## </summary>
  ## <param name="domain">
-@@ -4762,6 +5869,44 @@ interface(`dev_rw_xserver_misc',`
+@@ -4762,6 +5888,44 @@ interface(`dev_rw_xserver_misc',`
  
  ########################################
  ## <summary>
@@ -8668,7 +8858,7 @@ index 76f285e..6843613 100644
  ##	Read and write to the zero device (/dev/zero).
  ## </summary>
  ## <param name="domain">
-@@ -4851,3 +5996,1022 @@ interface(`dev_unconfined',`
+@@ -4851,3 +6015,1022 @@ interface(`dev_unconfined',`
  
  	typeattribute $1 devices_unconfined_type;
  ')
@@ -46841,7 +47031,7 @@ index 2cea692..e3cb4f2 100644
 +	files_etc_filetrans($1, net_conf_t, file)
 +')
 diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te
-index a392fc4..518cf50 100644
+index a392fc4..b01eb22 100644
 --- a/policy/modules/system/sysnetwork.te
 +++ b/policy/modules/system/sysnetwork.te
 @@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4)
@@ -47240,7 +47430,7 @@ index a392fc4..518cf50 100644
  ')
  
  optional_policy(`
-@@ -371,3 +497,13 @@ optional_policy(`
+@@ -371,3 +497,17 @@ optional_policy(`
  	xen_append_log(ifconfig_t)
  	xen_dontaudit_rw_unix_stream_sockets(ifconfig_t)
  ')
@@ -47250,6 +47440,10 @@ index a392fc4..518cf50 100644
 +')
 +
 +optional_policy(`
++    tlp_manage_pid_files(ifconfig_t)
++')
++
++optional_policy(`
 +	tunable_policy(`dhcpc_exec_iptables',`
 +		iptables_domtrans(dhcpc_t)
 +	')

policy-rawhide-contrib.patch

@@ -87708,7 +87708,7 @@ index c8bdea2..8ad3e01 100644
 +    allow $1 cluster_unit_file_t:service all_service_perms;
  ')
 diff --git a/rhcs.te b/rhcs.te
-index 6cf79c4..943fd8b 100644
+index 6cf79c4..4538e45 100644
 --- a/rhcs.te
 +++ b/rhcs.te
 @@ -20,6 +20,35 @@ gen_tunable(fenced_can_network_connect, false)
@@ -87747,7 +87747,7 @@ index 6cf79c4..943fd8b 100644
  attribute cluster_domain;
  attribute cluster_log;
  attribute cluster_pid;
-@@ -44,34 +73,284 @@ type foghorn_initrc_exec_t;
+@@ -44,34 +73,288 @@ type foghorn_initrc_exec_t;
  init_script_file(foghorn_initrc_exec_t)
  
  rhcs_domain_template(gfs_controld)
@@ -87957,6 +87957,10 @@ index 6cf79c4..943fd8b 100644
 +')
 +
 +optional_policy(`
++    fprintd_dbus_chat(cluster_t)
++')
++
++optional_policy(`
 +    ldap_systemctl(cluster_t)
 +')
 +
@@ -88036,7 +88040,7 @@ index 6cf79c4..943fd8b 100644
  ')
  
  #####################################
-@@ -79,13 +358,14 @@ optional_policy(`
+@@ -79,13 +362,14 @@ optional_policy(`
  # dlm_controld local policy
  #
  
@@ -88053,7 +88057,7 @@ index 6cf79c4..943fd8b 100644
  kernel_rw_net_sysctls(dlm_controld_t)
  
  corecmd_exec_bin(dlm_controld_t)
-@@ -98,16 +378,30 @@ fs_manage_configfs_dirs(dlm_controld_t)
+@@ -98,16 +382,30 @@ fs_manage_configfs_dirs(dlm_controld_t)
  
  init_rw_script_tmp_files(dlm_controld_t)
  
@@ -88087,7 +88091,7 @@ index 6cf79c4..943fd8b 100644
  manage_files_pattern(fenced_t, fenced_lock_t, fenced_lock_t)
  files_lock_filetrans(fenced_t, fenced_lock_t, file)
  
-@@ -118,9 +412,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir })
+@@ -118,9 +416,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir })
  
  stream_connect_pattern(fenced_t, groupd_var_run_t, groupd_var_run_t, groupd_t)
  
@@ -88099,7 +88103,7 @@ index 6cf79c4..943fd8b 100644
  
  corecmd_exec_bin(fenced_t)
  corecmd_exec_shell(fenced_t)
-@@ -140,6 +433,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t)
+@@ -140,6 +437,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t)
  
  corenet_sendrecv_zented_server_packets(fenced_t)
  corenet_tcp_bind_zented_port(fenced_t)
@@ -88108,7 +88112,7 @@ index 6cf79c4..943fd8b 100644
  corenet_tcp_sendrecv_zented_port(fenced_t)
  
  corenet_sendrecv_http_client_packets(fenced_t)
-@@ -148,9 +443,8 @@ corenet_tcp_sendrecv_http_port(fenced_t)
+@@ -148,9 +447,8 @@ corenet_tcp_sendrecv_http_port(fenced_t)
  
  dev_read_sysfs(fenced_t)
  dev_read_urand(fenced_t)
@@ -88120,7 +88124,7 @@ index 6cf79c4..943fd8b 100644
  
  storage_raw_read_fixed_disk(fenced_t)
  storage_raw_write_fixed_disk(fenced_t)
-@@ -160,7 +454,7 @@ term_getattr_pty_fs(fenced_t)
+@@ -160,7 +458,7 @@ term_getattr_pty_fs(fenced_t)
  term_use_generic_ptys(fenced_t)
  term_use_ptmx(fenced_t)
  
@@ -88129,7 +88133,7 @@ index 6cf79c4..943fd8b 100644
  
  tunable_policy(`fenced_can_network_connect',`
  	corenet_sendrecv_all_client_packets(fenced_t)
-@@ -182,7 +476,8 @@ optional_policy(`
+@@ -182,7 +480,8 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -88139,7 +88143,7 @@ index 6cf79c4..943fd8b 100644
  ')
  
  optional_policy(`
-@@ -190,12 +485,17 @@ optional_policy(`
+@@ -190,12 +489,17 @@ optional_policy(`
  ')
  
  optional_policy(`
@@ -88158,7 +88162,7 @@ index 6cf79c4..943fd8b 100644
  ')
  
  optional_policy(`
-@@ -203,6 +503,21 @@ optional_policy(`
+@@ -203,6 +507,21 @@ optional_policy(`
  	snmp_manage_var_lib_dirs(fenced_t)
  ')
  
@@ -88180,7 +88184,7 @@ index 6cf79c4..943fd8b 100644
  #######################################
  #
  # foghorn local policy
-@@ -221,16 +536,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t)
+@@ -221,16 +540,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t)
  corenet_tcp_connect_agentx_port(foghorn_t)
  corenet_tcp_sendrecv_agentx_port(foghorn_t)
  
@@ -88205,7 +88209,7 @@ index 6cf79c4..943fd8b 100644
  	snmp_stream_connect(foghorn_t)
  ')
  
-@@ -247,16 +568,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_
+@@ -247,16 +572,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_
  stream_connect_pattern(gfs_controld_t, fenced_var_run_t, fenced_var_run_t, fenced_t)
  stream_connect_pattern(gfs_controld_t, groupd_var_run_t, groupd_var_run_t, groupd_t)
  
@@ -88227,7 +88231,7 @@ index 6cf79c4..943fd8b 100644
  optional_policy(`
  	lvm_exec(gfs_controld_t)
  	dev_rw_lvm_control(gfs_controld_t)
-@@ -275,10 +600,57 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t)
+@@ -275,10 +604,57 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t)
  
  dev_list_sysfs(groupd_t)
  
@@ -88287,7 +88291,7 @@ index 6cf79c4..943fd8b 100644
  ######################################
  #
  # qdiskd local policy
-@@ -292,7 +664,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t)
+@@ -292,7 +668,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t)
  manage_sock_files_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t)
  files_var_lib_filetrans(qdiskd_t, qdiskd_var_lib_t, { file dir sock_file })
  
@@ -88295,7 +88299,7 @@ index 6cf79c4..943fd8b 100644
  kernel_read_software_raid_state(qdiskd_t)
  kernel_getattr_core_if(qdiskd_t)
  
-@@ -321,6 +692,8 @@ storage_raw_write_fixed_disk(qdiskd_t)
+@@ -321,6 +696,8 @@ storage_raw_write_fixed_disk(qdiskd_t)
  
  auth_use_nsswitch(qdiskd_t)
  
@@ -109009,6 +109013,267 @@ index 97cd155..49321a5 100644
  files_search_tmp(timidity_t)
  
  fs_search_auto_mountpoints(timidity_t)
+diff --git a/tlp.fc b/tlp.fc
+new file mode 100644
+index 0000000..8b8cf4a
+--- /dev/null
++++ b/tlp.fc
+@@ -0,0 +1,5 @@
++/usr/lib/systemd/system/((tlp-sleep.*)|(tlp.*))		--	gen_context(system_u:object_r:tlp_unit_file_t,s0)
++
++/usr/sbin/tlp		--	gen_context(system_u:object_r:tlp_exec_t,s0)
++
++/var/run/tlp(/.*)?		gen_context(system_u:object_r:tlp_var_run_t,s0)
+diff --git a/tlp.if b/tlp.if
+new file mode 100644
+index 0000000..46f12a4
+--- /dev/null
++++ b/tlp.if
+@@ -0,0 +1,184 @@
++
++## <summary>policy for tlp</summary>
++
++########################################
++## <summary>
++##	Execute tlp_exec_t in the tlp domain.
++## </summary>
++## <param name="domain">
++## <summary>
++##	Domain allowed to transition.
++## </summary>
++## </param>
++#
++interface(`tlp_domtrans',`
++	gen_require(`
++		type tlp_t, tlp_exec_t;
++	')
++
++	corecmd_search_bin($1)
++	domtrans_pattern($1, tlp_exec_t, tlp_t)
++')
++
++######################################
++## <summary>
++##	Execute tlp in the caller domain.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`tlp_exec',`
++	gen_require(`
++		type tlp_exec_t;
++	')
++
++	corecmd_search_bin($1)
++	can_exec($1, tlp_exec_t)
++')
++
++########################################
++## <summary>
++##	Search tlp conf directories.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`tlp_search_conf',`
++	gen_require(`
++		type tlp_etc_rw_t;
++	')
++
++	allow $1 tlp_etc_rw_t:dir search_dir_perms;
++	files_search_etc($1)
++')
++
++########################################
++## <summary>
++##	Read tlp conf files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`tlp_read_conf_files',`
++	gen_require(`
++		type tlp_etc_rw_t;
++	')
++
++	allow $1 tlp_etc_rw_t:dir list_dir_perms;
++	read_files_pattern($1, tlp_etc_rw_t, tlp_etc_rw_t)
++	files_search_etc($1)
++')
++
++########################################
++## <summary>
++##	Manage tlp conf files.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`tlp_manage_conf_files',`
++	gen_require(`
++		type tlp_etc_rw_t;
++	')
++
++	manage_files_pattern($1, tlp_etc_rw_t, tlp_etc_rw_t)
++	files_search_etc($1)
++')
++
++########################################
++## <summary>
++##	Execute tlp server in the tlp domain.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed to transition.
++##	</summary>
++## </param>
++#
++interface(`tlp_systemctl',`
++	gen_require(`
++		type tlp_t;
++		type tlp_unit_file_t;
++	')
++
++	systemd_exec_systemctl($1)
++        systemd_read_fifo_file_passwd_run($1)
++	allow $1 tlp_unit_file_t:file read_file_perms;
++	allow $1 tlp_unit_file_t:service manage_service_perms;
++
++	ps_process_pattern($1, tlp_t)
++')
++
++########################################
++## <summary>
++##	Read all dbus pid files
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`tlp_manage_pid_files',`
++	gen_require(`
++		type tlp_var_run_t;
++	')
++
++	files_search_pids($1)
++	read_files_pattern($1, tlp_var_run_t, tlp_var_run_t)
++')
++
++########################################
++## <summary>
++##	All of the rules required to administrate
++##	an tlp environment
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <param name="role">
++##	<summary>
++##	Role allowed access.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`tlp_admin',`
++	gen_require(`
++		type tlp_t;
++		type tlp_etc_rw_t;
++	type tlp_unit_file_t;
++	')
++
++	allow $1 tlp_t:process { signal_perms };
++	ps_process_pattern($1, tlp_t)
++
++    tunable_policy(`deny_ptrace',`',`
++        allow $1 tlp_t:process ptrace;
++    ')
++
++	files_search_etc($1)
++	admin_pattern($1, tlp_etc_rw_t)
++
++	tlp_systemctl($1)
++	admin_pattern($1, tlp_unit_file_t)
++	allow $1 tlp_unit_file_t:service all_service_perms;
++	optional_policy(`
++		systemd_passwd_agent_exec($1)
++		systemd_read_fifo_file_passwd_run($1)
++	')
++')
+diff --git a/tlp.te b/tlp.te
+new file mode 100644
+index 0000000..7c81c68
+--- /dev/null
++++ b/tlp.te
+@@ -0,0 +1,54 @@
++policy_module(tlp, 1.0.0)
++
++########################################
++#
++# Declarations
++#
++
++type tlp_t;
++type tlp_exec_t;
++init_daemon_domain(tlp_t, tlp_exec_t)
++
++type tlp_var_run_t;
++files_pid_file(tlp_var_run_t)
++
++type tlp_unit_file_t;
++systemd_unit_file(tlp_unit_file_t)
++
++########################################
++#
++# tlp local policy
++#
++allow tlp_t self:capability { net_admin sys_rawio };
++allow tlp_t self:unix_stream_socket create_stream_socket_perms;
++allow tlp_t self:udp_socket create_socket_perms;
++
++manage_dirs_pattern(tlp_t, tlp_var_run_t, tlp_var_run_t)
++manage_files_pattern(tlp_t, tlp_var_run_t, tlp_var_run_t)
++files_pid_filetrans(tlp_t, tlp_var_run_t, { dir file })
++
++kernel_read_system_state(tlp_t)
++kernel_read_fs_sysctls(tlp_t)
++kernel_rw_fs_sysctls(tlp_t)
++kernel_rw_kernel_sysctl(tlp_t)
++kernel_rw_vm_sysctls(tlp_t)
++
++auth_read_passwd(tlp_t)
++
++corecmd_exec_bin(tlp_t)
++
++dev_list_sysfs(tlp_t)
++dev_manage_sysfs(tlp_t)
++
++files_read_kernel_modules(tlp_t)
++
++modutils_exec_insmod(tlp_t)
++modutils_read_module_config(tlp_t)
++
++storage_raw_read_fixed_disk(tlp_t)
++
++sysnet_exec_ifconfig(tlp_t)
++
++optional_policy(`
++    fstools_exec(tlp_t)
++')
 diff --git a/tmpreaper.te b/tmpreaper.te
 index 585a77f..a7cb326 100644
 --- a/tmpreaper.te

selinux-policy.spec

@@ -19,7 +19,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 3.13.1
-Release: 225%{?dist}
+Release: 226%{?dist}
 License: GPLv2+
 Group: System Environment/Base
 Source: serefpolicy-%{version}.tgz
@@ -675,6 +675,11 @@ exit 0
 %endif
 
 %changelog
+* Wed Nov 16 2016 Lukas Vrabec  <lvrabec@redhat.com> - 3.13.1-226
+- Adding policy for tlp
+- Add interface  dev_manage_sysfs()
+- Allow ifconfig domain to manage tlp pid files.
+
 * Wed Nov 09 2016 Lukas Vrabec  <lvrabec@redhat.com> - 3.13.1-225
 - Allow systemd_logind_t domain to communicate with devicekit_t domain via dbus bz(1393373)