From 99509b3f868e60223e0b4e69bcafd7bf94c2f4a4 Mon Sep 17 00:00:00 2001 From: Lukas Vrabec Date: Wed, 16 Nov 2016 14:46:50 +0100 Subject: [PATCH] * Wed Nov 16 2016 Lukas Vrabec - 3.13.1-226 - Adding policy for tlp - Add interface dev_manage_sysfs() - Allow ifconfig domain to manage tlp pid files. --- container-selinux.tgz | Bin 4909 -> 4906 bytes policy-rawhide-base.patch | 582 +++++++++++++++++++++++------------ policy-rawhide-contrib.patch | 297 +++++++++++++++++- selinux-policy.spec | 7 +- 4 files changed, 675 insertions(+), 211 deletions(-) diff --git a/container-selinux.tgz b/container-selinux.tgz index 84868715106d553ef77ba0271c4fc3dc132333bf..9633bb796783c143505c5fe64457f4a5ecb4af2a 100644 GIT binary patch literal 4906 zcmV+_6V>b=iwFSpVk}qy1MOYwkKDEq&)3_(La+n)F0k)mrw(vVTNH6W^h1##&9|mi zwGww%v0fFad(`m%-Wfh5N+Kz0S8HF36>#2NY34_ANDgO)Lpd%B7NrHLFVoFeN4l=z zdi(ZU{Ji<@ch~wSTyL&#-oE+j20q?gzrA^bbT@BaUtfO}Tpz1K`qfYt)j{x8c2`Gh z5?kq}p8tQ6|tUjtbvbX~9UniDGj8ueLT}-4ra%NeJa}oEIoM7MC@N^CYAss^eX_PK)!eZ!T76 zs<^O<7}N^y+QCdu*u@G9I6_B(WS?v=p*-gFkY8uSQNbylop7MM|HjMI#GR$odrl?xLDJC8_fY`O969dq_P?DZ{aC6S@R4-16zNY3{7}us4E#hmX4ZPkh$n z`b;Ylr<)WyNOUBwtz@L~c$tY95XgVv;(kOuc-TO(Xtq5>ZV>ukqaxZ47m}wj$8uh^ zqvtWmzk$3dIvA1G6;MjA zJ06kcK4rTg0>XxYgjpH~y!D;)0O}6uB25ogb$W;8AmwN5&;hcnMToU9;G-+fn^JDL zCKf_Lbpe(P|l7Rg*N8;-H()!JZ9Of$kV&=v!+NH7k}4L0y~k0mMTc}R*K{` z$x1ZVK~gD(UoP#_mD`BQPP z&MFvUb%`@zB7nAtn-vvFa9^h;13M=u&9gy8G#F3&&Jd{S zq_j!5m!!B`5_MNnMwbTU_V|LBHKAp8cZm{M1XlDC8W<7|)M*X6B#e?gEyN_j@U*SN z#Vk@dmwI;}=8u*|p`5N(6P9QrMgdqK4*_MMCv!e|2>arTx~L5*L9F%O8}-X?I&W&ZrhfUbBkeg;klQ z@gpDM%FCB-J$Ty%Q#&db+VhDhz>B4$H(}JUolLzLg>d-8CzhhZ>pLflh%@xGh1TQ) z^M^E~(e1-FBF!CjX!6jJ^tzIQcXu3=FQg$H!B7=)e!4afZ~c6ebvz5ItN|6ftl2um z^nEse!WepU7Ww*#IY5I=DDANW$(STEsEZ$xF=wJf8a{53+)(Ydy%7nYI;u3@ z+qCR^a(y=3oV19&zqx1I`E%5&za?ceTFtzAHN>&xp|N^bQ$cu(RCGzz-JpuARG z$0UTta`Uy4+pYvRFQJ&=en&tJ*7`gf({%sG=UqMYueD zd5C)>5$YkDF};@%ok0-2U79=C-?}{SJsl5-Hh9>tqP9yc@VL0lF-PMjZy!!={HmQU z{1i81v4?#=q!DWG%slDR!A(shlR6!Y#9&Q7l z511TNHLpg~6>qgY13w0cJys|3h8nOpw1*Bq?f6J*9#wq6jYpMvl$xW_1Jq$Cq7Oa} zj9AMUl8%egg2w$)dfO5z`rF<-HzJJTRf$GSS`uL4Hx(7_Q0Z820 znJ5@mUA0G8lMF1R4EG2pn7ZwxEdkGh)&2b>D80_oJY~EdR3;-$*QMQV!2Bp}??LQm zOfZ`^J$b?Xo1SPat`l(}q^0NL-x55v(@_-A+DWzzlFkaxGSe z@tDYjg`|=@#_OT!w8Eia$YEGw}u=0Hr0tWdy?4j%&CBWV4C1m zeS%LHUW$z)+^Wea&c(nI$N*EWVVkfC7}+NQ5b`!%OMsKDKQh zV9p*K9+*qx&7SQpOrIW>#4}e--%;FFWtnBxoLPPpY)r7pqQ@h{zg`~Sbd2FRMQBG5 zj#mI4npi#WXe>vA+>YrSP@EOMAL#2bU zd*AArE-Z_&+Tra_GCD6Kl>H#Ru`OEU{sTypWHQM_>^JgU6SJPysSCpH%ld;aIZtqZ zq%q5kqV9^Tg9|qL`(3Fi{dq`I0`tXHCM7<;z0E z6Y3JmN@XeYJ=3*$i~6EZMRz329B?Qx3={Lcgf0B6(>N^3#8L&Fg_0tHlI~izbh8K3 zo@EWTY%FZNRlEx^0b!axmT3n&#wyPu6iZy@d6kiekazGjFW(@TD?uaEv;=!>p5j2B znS-KbnJ7XkQ9ktJZjakSEr`1rBln%eq`{oa*<6mo&<7Xw+SX-LIqM}Uh2u;g^DHes z*lA@pdt{r9K+>zDt%8)5HLh%RbRY7)vIj7clazk2(DN-G)K3Ma_bH2aW;%JMWhgGN z*OT(z0xjPwqLK{FRGbK(H?|ga2d!}E@Zxj2wNUqnLDgee7N~8`K}ut7uHUP_z_vxUl9(&{bmPP| z90;qc-0I<9h{vLZYX^lL;Dx!=4GiEiqZ1;wFsBv6M6o@&@%`9$ViI_5dh$f!)$<^G zh{cgt%!`||o1a8+h+%*_O$gdx+cd$C3is#Xv%#N_RPN~Gw{=-E{sjy*^;I6*1Y2#^ z-n=YBeqcB8qGc7h^)osOI#mD+HdJyUsK$0fI}m0Uzu(*9p4{VBTw==iH_MHPUU>k? zw(imZKAJY)1JoVDv74V*@X?VJ5X9=J^@K1j9%&bHoyR&3+4=_W^wc+L^>%B3myx^` z7WZ9RfeI=%<%C83?}kto@;6Zp^HvS?vOQrAqZ-ycw@t5z-4?rn*y%8=z~j*uW{X*` z5dj>A@NEtNP;#x>fcmnCwx!ALxQ1eN=_nUp+Jr?qDYCMxyr3qFl$MohZA!rv#+0i` zTTFW72QW+;i6f2)tIW*Q#^`2owGlWMmsqK3doagUfE=Mn?L$|IJr)t^L23Lb4I6PI67bDK)aeIC;SS1+Lrxa=%{RtoVymahmNIYVf#zH${bX!{Cqq;KM4P0#q z3vW0BSRIGximo6>>y1n*nPe`HT|t-}hHcf2FZhnfA?NrT$-1E`G>TuvyVNYslsG%V z$##*GNDKq<1`B+J2M!-go1E_fX$!;LrqpJPnCSB;-T|GB+W8B#Dz z*QG`0c4aF%*E|%|YLmy8Ud`Gb10RGIuIIs~tkF%E0NvYNLMmElZ_>;5uvB}TzQ-f` z+~kbiZW4Uo-8aC{;lth4pw)RB1A*(6tQk6@y-dFQ{u%)^u2#xouK zTpfl4#t!v3=OOqseiwu5u-@psKNG%un_3|c0?y^vcB>_VW5Ds3&2{l6YedO#qTD7X4IgUky6d=*!c)0g$y{!Z z_HGOJ`#-MV-oUfL`#)~JdwY8S$LF}NaEtKj*GqAznZMqL$7>#7=@qMUb1VPQvUs)SO54%=%=$+ue|ZqaxULViRGAz5g(V|ECIbv ziw7OS#^jhh<0qUCXm@~+I9oV=34m;jF2es%fH#UIbSv0`-|mrJ6$dx+;k$~RT$K->LrlqUJoKF{eoU8n1Govzb$x=z>WI$fvhbe*o#b-GU1 c={jAf>vWy2({;K|*Z=eNUuwIkTmYZ|09SCLKmY&$ literal 4909 zcmV+|6VmJ-iwFQC8Y5T$1MOYwkK4Er&)4-|AtVQ6_mJ!(NpryF+M>AYhkht}XzyFE zRb`2`bbWiEFiHh&HP9X$>Gd!sEx~lMQK6m%XIVXNY^!7 z@87?}&ztXlbFF{E_4fMa{o7|Z@NxbA<~P^x-afm&d3*ESyJx}mu_~lr4P{Xs1kbX& zI$D$1N;mcVfAm_tcoBS0n>>%|$KURaqKGEG>&5Rs$s<#TGs< zzrRv!D**AkdZodSvp+tNxM4&?Pm6%<^czW;!@O_mQjMSSbCg=ZZYZKN@!P1jtj=CutX5}nS(7+VLQ0}K-i7P5IRED6 zVs)m93#*7ht?;fL%=Cm^tgwJ1bQDPT$@UV;V@?nGbw(T&oYL6|2g>_zyi85pS-K7q zsD8}KIwf?5q|aQEj^db5j&?Rr#8N0wEgu2jMKzLkvgPFm-`tpJZlRrl#D}k8Me3Xa z<0j1rRRv3G-XjZ-?58GbKA^s&pe+NuNTgdwui_KLjQAAMBCv)@-*gH z&Z~Ab-6r7=(QXQ3YQh{o187XpO6B@jkT*pKBhtD8 zO6hgSBeLA5Y!^g8*f5YVOXGmIzH=Tx-6371>A|W_@30)C{DK`iK$f)#u@(k=bj5j7 z$_>}VLMW)bV=kpRMG4+8<=JMe%3jverZvm&_>-|9>8o70N%#e*2u&jjf4DIw*Ec z(qijXta*wk9p~+y8z+d%+twz*H*etITln{GS^Mm#KmGVbRt|2(RB1AA-2h+MqHq9; z&M=5Mkn!f?ZXYG}-68=fXGe@e8*}~cN6JVZvusx6>BIP0Q>2WGzw0Q0ok&AV6(o8q zMe>?tB^v7>sT9T&e-g+`G0Se%UgMG+BIgXV#NI8`Sbh@9T4FEw zcZ0V4TPRu|5}yqxNLFt77Ac%dy}J+dN6Vs6PFJf5OSBQA0IZLPfHKgNIiEa)ef33M)CQFx)_U)aNni85 zU))|M{4p#rt<(PY(+^z%^eOjT6?^v{(xSqK58s{=x48`!LS4BQ7cHj)o1BB+qJ&g^ z1YIDj#mZU6hA}R!-2J+NS_QIw+%MwOJ%xh7_TWLAe%8TVT9-vW%L+M8cky~2>V8=x zX{txv{@U0Kfd$~C$PF}kVZh$Z4qU{{tP~UnCD?ZVO+7B301}1 zp-LBm7LT;fi79>=Vi@qFlsy1MXCSvSc3S?e7rSh}!Rw#q*2c-SyR95&R0|`oSw--| zs?5^(k&kfYaI}XYh(h!bds0ukhU7Lrue!j^%o&{CbfQnt# zY#n0yKAS&b481vwJoBKzx@?Ms@(F|6Bg^PAvBT5CACPF*RdKJNqTa$W6)azeo1L%< zM#ZB6UalEJ7GQG1f>u9PB{Wx9swtJy{&F)0zSm_&;;6cslzdm+eG?sBrk|h_QTeVU z(HmN|64WV!M70h~-EMRB#+=3+pur}T_Sk`BOcEK?#Sh7tGtnUpAGb(usCL`lh=fla zRT}SYTJ}A;J{xXMTEyPp+_UZcIcnA4lCl}CW?nsVuCc1yu2RQqhbnRPQ&H)wU0cUF74`q{fr!| z4EOn;ch_&fyB?nZd2{{U>HN=^xP)sT=4H}k&xp|N^bQc_>sgJXcTmb zL3ypXj!6iO<>qT8w_OQtUP3X!{f>Ydto4n?h}&5z;K;**Sr+{K!%sm~)~wx~t)v1I z=%|%gQ$%aM4Xuq2cHgUD6J?Y@du*mC6q811>hWa(w3*X#>QgIgiswiq5y{IU6w3MB zP?GD+h~Nrov;H-Nl{el+#g;$Kc`U{R*D|5W=*h9t)wX2ETjx?sBa}?&2y5;jP(?kI zi*R}R@(}k%BGf}PV|p(kI)fm3yEJ#Ozjb-udpaHvZSb&PMQxW@;Bj%8V~)m6-aee# z_*FYy_$hA2Vh{U#$Unwafzm#57uOZ_l)rh?jX_ppAi0mJg3AIiQ+vhdLoO5AsDd&e zJ=_L9A22zlYF>?|E8c2*27U|>d#q064K-kIXb&BJ+VPRrJgWGB8;>gUC^bi;2dKkP zL?3({7_pWyBpnx}1&#Zq^tL5b^tZivZbTTvs}z?$c9$U|vR&BY`Iu!4CO4M*SZxxA z5JFx;mvLwIe8gxFG%P(M@$!2gRv7gw2;;xchb(g!&~71w85L!LSf1gL@X<}{7A4u{ zHjb)jon|R}3_b<%uDmaTk14F18~6rb8%kK31o_9JOaiPd-$3Bs)@jiu^zj>YbPt$p z1CY40Gf^BWTLPX1tNZ&&Pv|wiE0}2J7nF5iI%T_rDbsm z5BKc*o_TA1u-{mii9LI4_~Q3%d#{l)fVPa70|k!uzT?rsLifc#MDYG?kT%sZ3sFh# z$1G!=9Z^_5DrmsOU&Ns49`Gtu&cM8i!93Aj)Vb3{v`t@=_G?aiP=UKyW$|IJS>`$$ zzwco2z??leJTRBWn?2iIm_9u$iD#~wzN5IU$}-EWIkWsI*qC6GMUO{@f3rNk=@`Rt ziqMWA9IpU8G_iWo(O8ZKxgFCv%4zB({5})k6LYrG^TeI4_&jmj!$nI2&(?xdxIUV& z_x7Zj9)#)el7E#KG+?KWR_{A{y)fq*k)FW&4Kokmy@r_!*L0Z9AJQ}o+P3on;WLcK zhe`)y_rBFLU04=lwZq$=WprLfDEmQrV_USy{YQ`{$z+m=*l*;yCT2aYQx}BYm-RlN2BR60%=ZUA`L@`V6V4@_J@+EzO&zgiE z%a?_SC)6dBmC91)d!}pi7WGA+itb33Ip9!Y7$)X>30wGCr*T-6iKPlU3nfJYCEc}b z>1Ge6JU(XEYl8lj8&dRD3-X)^C}|`A@AU6UcNyvSAs^SX$kh& zJjH=LGY3V>GEsz7qI~Gb-5$4vS`c?LM(#U_NrO3;v$-6Fp${(VwXMsha@I>y3dfl~ z=2=>NwA0FL_Q*CHfuvVQTLmdAYh2mt=sx6oWe;E?Cn^1Cq32sXsGkZ-?^71<%yjZh z%TQckuP5cb1zNsWL?s!TsW=fnZ)`2<4qD;R;l<~4YoYEDgQ~}{EKu8=gOtYFVB;IJ z>3Bfm`I1pA>xz)qJ5RXL**A5Chz)N$f8yLW4MkhpUVNNTCiDG+lZ?4q z3AWm-y?I%N{J?JFMawF1>t}QnbgBRtY^dZyP>t<|b|B0ye!sWHJ-NrNxWtt2Zdss;FBXMAc)mb>j`06Jkl=YI*)Z6vh@w#>8Wqh>h0D5 zFC%#?EbhCs0u@wj$_b15-wmNGwwUzD4`7%y5=R^pR+*WpjnU2GY9nwiF0oS6_F#^y069XD+J~-yf0V>cotnLP z6K=n~c8gdTMJ}@xh?>HStR^00z7lBrL7MB1AvGj*bifO&Cah{yZpGQif}j8L<6nZm zLWAx|@H3t^6xI}y!wCS}r=b>Y%S=jzkZ*nx3qjK1M4BeJi_^7Uo zb^})%!onNQ09MB#x}qz{(Rw43N+y}hV^{Xy9!5$s z+0d6(p`wAZm-pASW|hsMwJ{dlvo0{sVm%oI%YjbVor<4T)LmM$=^%k1bGYvOxzEHm zQHB%@({*Xlxn0?c&NUAOwc6zIrB}1I$G``nh3iGIDQk4oB|!Ifmyn7U+MD#MJuKB8 zr|+as7LZQl8BF!S(a zxA9B|KUaq#fw4n9&UpwvkKe`MI;=N(@6UuU-=mz}QRu6SDHW<-V%RB7n?6zX94aTrrny$}{mx#AS0_yz zz>?=)_c(Z@bIv?<)W+2;a9ZHFJ>}Iqt7Bcy)tieZl1ZjtzvOy0nOCw9yfYJIp)y=a zA%_;>&JXcHpUx5SN;+sq#US&-5bkVAU3-Nsk+z?vjtCjS{Px~j^68B)Mf$bhyYN)5 zRx+2HqrKb0{r->Z_c!ot^!I{V#p>ML%D*2} z-*(eT9!{kAhLEd<)>mNkp+9#eaIRX)zyI^O-PG97aVf zSi%wdvnxY-4f1op!Kl4uL88O@DxuD=F2B9_{h2pbtj^w^K-l_>2OJlWt4s=QwlWJ^U6{qoyi@VusfeZ|SoX<&6&!XMec()^snGQb!^ zp4(+EJbBJVLN18-<^aec=APr;IaDR)5k{;+HV@o`$E_KD(cx<^Vwq8_@E0D;3U=`^ zJpev@Xv1oBfch1#W?N4LYYCE>b+h1!%Kd_W)o9i#I01*AFyPT;@Z_I2T1bRaeF@Wo z&IKJs0yI4az*pHrJQq^FsX_WI$fvhbe*o# fb-GU1={jAf>vWy2({;N3pRfM{yc-sD0H6Q>R1cC@ diff --git a/policy-rawhide-base.patch b/policy-rawhide-base.patch index e4bcf7d5..e01d341f 100644 --- a/policy-rawhide-base.patch +++ b/policy-rawhide-base.patch @@ -6601,7 +6601,7 @@ index b31c054..1ed65a0 100644 +/usr/lib/udev/devices/null -c gen_context(system_u:object_r:null_device_t,s0) +/usr/lib/udev/devices/zero -c gen_context(system_u:object_r:zero_device_t,s0) diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if -index 76f285e..6843613 100644 +index 76f285e..72f99c0 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -143,13 +143,32 @@ interface(`dev_relabel_all_dev_nodes',` @@ -8048,7 +8048,7 @@ index 76f285e..6843613 100644 ## ## ## -@@ -4024,17 +4722,243 @@ interface(`dev_rw_sysfs',` +@@ -4024,17 +4722,262 @@ interface(`dev_rw_sysfs',` ## ## # @@ -8274,6 +8274,25 @@ index 76f285e..6843613 100644 + +######################################## +## ++## Allow caller to modify hardware state information. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_manage_sysfs',` ++ gen_require(` ++ type sysfs_t; ++ ') ++ ++ manage_dirs_pattern($1, sysfs_t, sysfs_t) ++ manage_files_pattern($1, sysfs_t, sysfs_t) ++') ++ ++######################################## ++## +## Read and write the TPM device. +## +## @@ -8296,7 +8315,7 @@ index 76f285e..6843613 100644 ## ## ##

-@@ -4113,6 +5037,25 @@ interface(`dev_write_urand',` +@@ -4113,6 +5056,25 @@ interface(`dev_write_urand',` ######################################## ##

@@ -8322,7 +8341,7 @@ index 76f285e..6843613 100644 ## Getattr generic the USB devices. ## ## -@@ -4123,7 +5066,7 @@ interface(`dev_write_urand',` +@@ -4123,7 +5085,7 @@ interface(`dev_write_urand',` # interface(`dev_getattr_generic_usb_dev',` gen_require(` @@ -8331,84 +8350,264 @@ index 76f285e..6843613 100644 ') getattr_chr_files_pattern($1, device_t, usb_device_t) -@@ -4409,9 +5352,9 @@ interface(`dev_rw_usbfs',` - read_lnk_files_pattern($1, usbfs_t, usbfs_t) - ') +@@ -4330,28 +5292,180 @@ interface(`dev_search_usbfs',` --######################################## -+###################################### + ######################################## ## --## Get the attributes of video4linux devices. +-## Allow caller to get a list of usb hardware. ++## Allow caller to get a list of usb hardware. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_list_usbfs',` ++ gen_require(` ++ type usbfs_t; ++ ') ++ ++ read_lnk_files_pattern($1, usbfs_t, usbfs_t) ++ getattr_files_pattern($1, usbfs_t, usbfs_t) ++ ++ list_dirs_pattern($1, usbfs_t, usbfs_t) ++') ++ ++######################################## ++## ++## Set the attributes of usbfs filesystem. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_setattr_usbfs_files',` ++ gen_require(` ++ type usbfs_t; ++ ') ++ ++ setattr_files_pattern($1, usbfs_t, usbfs_t) ++ list_dirs_pattern($1, usbfs_t, usbfs_t) ++') ++ ++######################################## ++## ++## Read USB hardware information using ++## the usbfs filesystem interface. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_read_usbfs',` ++ gen_require(` ++ type usbfs_t; ++ ') ++ ++ read_files_pattern($1, usbfs_t, usbfs_t) ++ read_lnk_files_pattern($1, usbfs_t, usbfs_t) ++ list_dirs_pattern($1, usbfs_t, usbfs_t) ++') ++ ++######################################## ++## ++## Allow caller to modify usb hardware configuration files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_rw_usbfs',` ++ gen_require(` ++ type usbfs_t; ++ ') ++ ++ list_dirs_pattern($1, usbfs_t, usbfs_t) ++ rw_files_pattern($1, usbfs_t, usbfs_t) ++ read_lnk_files_pattern($1, usbfs_t, usbfs_t) ++') ++ ++###################################### ++## +## Read and write userio device. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_rw_userio_dev',` ++ gen_require(` ++ type device_t, userio_device_t; ++ ') ++ ++ rw_chr_files_pattern($1, device_t, userio_device_t) ++') ++ ++######################################## ++## ++## Get the attributes of video4linux devices. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_getattr_video_dev',` ++ gen_require(` ++ type device_t, v4l_device_t; ++ ') ++ ++ getattr_chr_files_pattern($1, device_t, v4l_device_t) ++') ++ ++######################################## ++## ++## Do not audit attempts to get the attributes ++## of video4linux device nodes. ++## ++## ++## ++## Domain to not audit. ++## ++## ++# ++interface(`dev_dontaudit_getattr_video_dev',` ++ gen_require(` ++ type v4l_device_t; ++ ') ++ ++ dontaudit $1 v4l_device_t:chr_file getattr; ++') ++ ++######################################## ++## ++## Set the attributes of video4linux device nodes. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`dev_setattr_video_dev',` ++ gen_require(` ++ type device_t, v4l_device_t; ++ ') ++ ++ setattr_chr_files_pattern($1, device_t, v4l_device_t) ++') ++ ++######################################## ++## ++## Do not audit attempts to set the attributes ++## of video4linux device nodes. ## ## ## -@@ -4419,17 +5362,17 @@ interface(`dev_rw_usbfs',` +-## Domain allowed access. ++## Domain to not audit. ## ## # --interface(`dev_getattr_video_dev',` -+interface(`dev_rw_userio_dev',` +-interface(`dev_list_usbfs',` ++interface(`dev_dontaudit_setattr_video_dev',` gen_require(` -- type device_t, v4l_device_t; -+ type device_t, userio_device_t; +- type usbfs_t; ++ type v4l_device_t; ') -- getattr_chr_files_pattern($1, device_t, v4l_device_t) -+ rw_chr_files_pattern($1, device_t, userio_device_t) +- read_lnk_files_pattern($1, usbfs_t, usbfs_t) +- getattr_files_pattern($1, usbfs_t, usbfs_t) +- +- list_dirs_pattern($1, usbfs_t, usbfs_t) ++ dontaudit $1 v4l_device_t:chr_file setattr; ') --###################################### -+######################################## + ######################################## ## --## Read and write userio device. -+## Get the attributes of video4linux devices. +-## Set the attributes of usbfs filesystem. ++## Read the video4linux devices. ## ## ## -@@ -4437,12 +5380,12 @@ interface(`dev_getattr_video_dev',` +@@ -4359,19 +5473,17 @@ interface(`dev_list_usbfs',` ## ## # --interface(`dev_rw_userio_dev',` -+interface(`dev_getattr_video_dev',` +-interface(`dev_setattr_usbfs_files',` ++interface(`dev_read_video_dev',` gen_require(` -- type device_t, userio_device_t; +- type usbfs_t; + type device_t, v4l_device_t; ') -- rw_chr_files_pattern($1, device_t, userio_device_t) -+ getattr_chr_files_pattern($1, device_t, v4l_device_t) +- setattr_files_pattern($1, usbfs_t, usbfs_t) +- list_dirs_pattern($1, usbfs_t, usbfs_t) ++ read_chr_files_pattern($1, device_t, v4l_device_t) ') ######################################## -@@ -4539,7 +5482,7 @@ interface(`dev_write_video_dev',` + ## +-## Read USB hardware information using +-## the usbfs filesystem interface. ++## Write the video4linux devices. + ## + ## + ## +@@ -4379,19 +5491,17 @@ interface(`dev_setattr_usbfs_files',` + ## + ## + # +-interface(`dev_read_usbfs',` ++interface(`dev_write_video_dev',` + gen_require(` +- type usbfs_t; ++ type device_t, v4l_device_t; + ') + +- read_files_pattern($1, usbfs_t, usbfs_t) +- read_lnk_files_pattern($1, usbfs_t, usbfs_t) +- list_dirs_pattern($1, usbfs_t, usbfs_t) ++ write_chr_files_pattern($1, device_t, v4l_device_t) + ') ######################################## ## --## Allow read/write the vhost net device +-## Allow caller to modify usb hardware configuration files. +## Get the attributes of vfio devices. ## ## ## -@@ -4547,35 +5490,36 @@ interface(`dev_write_video_dev',` +@@ -4399,37 +5509,36 @@ interface(`dev_read_usbfs',` ## ## # --interface(`dev_rw_vhost',` +-interface(`dev_rw_usbfs',` +interface(`dev_getattr_vfio_dev',` gen_require(` -- type device_t, vhost_device_t; +- type usbfs_t; + type device_t, vfio_device_t; ') -- rw_chr_files_pattern($1, device_t, vhost_device_t) +- list_dirs_pattern($1, usbfs_t, usbfs_t) +- rw_files_pattern($1, usbfs_t, usbfs_t) +- read_lnk_files_pattern($1, usbfs_t, usbfs_t) + getattr_chr_files_pattern($1, device_t, vfio_device_t) ') ######################################## ## --## Read and write VMWare devices. +-## Get the attributes of video4linux devices. +## Do not audit attempts to get the attributes +## of vfio device nodes. ## @@ -8419,186 +8618,177 @@ index 76f285e..6843613 100644 ## ## # --interface(`dev_rw_vmware',` +-interface(`dev_getattr_video_dev',` +interface(`dev_dontaudit_getattr_vfio_dev',` gen_require(` -- type device_t, vmware_device_t; +- type device_t, v4l_device_t; + type vfio_device_t; ') -- rw_chr_files_pattern($1, device_t, vmware_device_t) +- getattr_chr_files_pattern($1, device_t, v4l_device_t) + dontaudit $1 vfio_device_t:chr_file getattr; ') - ######################################## +-###################################### ++######################################## ## --## Read, write, and mmap VMWare devices. +-## Read and write userio device. +## Set the attributes of vfio device nodes. ## ## ## -@@ -4583,12 +5527,157 @@ interface(`dev_rw_vmware',` +@@ -4437,18 +5546,18 @@ interface(`dev_getattr_video_dev',` ## ## # --interface(`dev_rwx_vmware',` +-interface(`dev_rw_userio_dev',` +interface(`dev_setattr_vfio_dev',` gen_require(` -- type device_t, vmware_device_t; +- type device_t, userio_device_t; + type device_t, vfio_device_t; ') -- dev_rw_vmware($1) +- rw_chr_files_pattern($1, device_t, userio_device_t) + setattr_chr_files_pattern($1, device_t, vfio_device_t) -+') -+ -+######################################## -+## -+## Do not audit attempts to set the attributes -+## of vfio device nodes. -+## -+## -+## -+## Domain to not audit. -+## -+## -+# -+interface(`dev_dontaudit_setattr_vfio_dev',` -+ gen_require(` -+ type vfio_device_t; -+ ') -+ -+ dontaudit $1 vfio_device_t:chr_file setattr; -+') -+ -+######################################## -+## -+## Read the vfio devices. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_read_vfio_dev',` -+ gen_require(` -+ type device_t, vfio_device_t; -+ ') -+ -+ read_chr_files_pattern($1, device_t, vfio_device_t) -+') -+ -+######################################## -+## -+## Write the vfio devices. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_write_vfio_dev',` -+ gen_require(` -+ type device_t, vfio_device_t; -+ ') -+ -+ write_chr_files_pattern($1, device_t, vfio_device_t) -+') -+ -+######################################## -+## -+## Read and write the VFIO devices. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rw_vfio_dev',` -+ gen_require(` -+ type device_t, vfio_device_t; -+ ') -+ -+ rw_chr_files_pattern($1, device_t, vfio_device_t) -+') -+ -+######################################## -+## -+## Allow read/write the vhost net device -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rw_vhost',` -+ gen_require(` -+ type device_t, vhost_device_t; -+ ') -+ -+ rw_chr_files_pattern($1, device_t, vhost_device_t) -+') -+ -+######################################## -+## -+## Allow read/write inheretid the vhost net device -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rw_inherited_vhost',` -+ gen_require(` -+ type device_t, vhost_device_t; -+ ') -+ -+ allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms; -+') -+ -+######################################## -+## -+## Read and write VMWare devices. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rw_vmware',` -+ gen_require(` -+ type device_t, vmware_device_t; -+ ') -+ -+ rw_chr_files_pattern($1, device_t, vmware_device_t) -+') -+ -+######################################## -+## -+## Read, write, and mmap VMWare devices. -+## -+## -+## -+## Domain allowed access. -+## -+## -+# -+interface(`dev_rwx_vmware',` -+ gen_require(` -+ type device_t, vmware_device_t; -+ ') -+ -+ dev_rw_vmware($1) - allow $1 vmware_device_t:chr_file execute; ') -@@ -4630,6 +5719,24 @@ interface(`dev_write_watchdog',` + ######################################## + ## +-## Do not audit attempts to get the attributes +-## of video4linux device nodes. ++## Do not audit attempts to set the attributes ++## of vfio device nodes. + ## + ## + ## +@@ -4456,17 +5565,17 @@ interface(`dev_rw_userio_dev',` + ## + ## + # +-interface(`dev_dontaudit_getattr_video_dev',` ++interface(`dev_dontaudit_setattr_vfio_dev',` + gen_require(` +- type v4l_device_t; ++ type vfio_device_t; + ') + +- dontaudit $1 v4l_device_t:chr_file getattr; ++ dontaudit $1 vfio_device_t:chr_file setattr; + ') + + ######################################## + ## +-## Set the attributes of video4linux device nodes. ++## Read the vfio devices. + ## + ## + ## +@@ -4474,36 +5583,35 @@ interface(`dev_dontaudit_getattr_video_dev',` + ## + ## + # +-interface(`dev_setattr_video_dev',` ++interface(`dev_read_vfio_dev',` + gen_require(` +- type device_t, v4l_device_t; ++ type device_t, vfio_device_t; + ') + +- setattr_chr_files_pattern($1, device_t, v4l_device_t) ++ read_chr_files_pattern($1, device_t, vfio_device_t) + ') + + ######################################## + ## +-## Do not audit attempts to set the attributes +-## of video4linux device nodes. ++## Write the vfio devices. + ## + ## + ## +-## Domain to not audit. ++## Domain allowed access. + ## + ## + # +-interface(`dev_dontaudit_setattr_video_dev',` ++interface(`dev_write_vfio_dev',` + gen_require(` +- type v4l_device_t; ++ type device_t, vfio_device_t; + ') + +- dontaudit $1 v4l_device_t:chr_file setattr; ++ write_chr_files_pattern($1, device_t, vfio_device_t) + ') + + ######################################## + ## +-## Read the video4linux devices. ++## Read and write the VFIO devices. + ## + ## + ## +@@ -4511,17 +5619,17 @@ interface(`dev_dontaudit_setattr_video_dev',` + ## + ## + # +-interface(`dev_read_video_dev',` ++interface(`dev_rw_vfio_dev',` + gen_require(` +- type device_t, v4l_device_t; ++ type device_t, vfio_device_t; + ') + +- read_chr_files_pattern($1, device_t, v4l_device_t) ++ rw_chr_files_pattern($1, device_t, vfio_device_t) + ') + + ######################################## + ## +-## Write the video4linux devices. ++## Allow read/write the vhost net device + ## + ## + ## +@@ -4529,17 +5637,17 @@ interface(`dev_read_video_dev',` + ## + ## + # +-interface(`dev_write_video_dev',` ++interface(`dev_rw_vhost',` + gen_require(` +- type device_t, v4l_device_t; ++ type device_t, vhost_device_t; + ') + +- write_chr_files_pattern($1, device_t, v4l_device_t) ++ rw_chr_files_pattern($1, device_t, vhost_device_t) + ') + + ######################################## + ## +-## Allow read/write the vhost net device ++## Allow read/write inheretid the vhost net device + ## + ## + ## +@@ -4547,12 +5655,12 @@ interface(`dev_write_video_dev',` + ## + ## + # +-interface(`dev_rw_vhost',` ++interface(`dev_rw_inherited_vhost',` + gen_require(` + type device_t, vhost_device_t; + ') + +- rw_chr_files_pattern($1, device_t, vhost_device_t) ++ allow $1 vhost_device_t:chr_file rw_inherited_chr_file_perms; + ') + + ######################################## +@@ -4630,6 +5738,24 @@ interface(`dev_write_watchdog',` ######################################## ## @@ -8623,7 +8813,7 @@ index 76f285e..6843613 100644 ## Read and write the the wireless device. ## ## -@@ -4762,6 +5869,44 @@ interface(`dev_rw_xserver_misc',` +@@ -4762,6 +5888,44 @@ interface(`dev_rw_xserver_misc',` ######################################## ## @@ -8668,7 +8858,7 @@ index 76f285e..6843613 100644 ## Read and write to the zero device (/dev/zero). ## ## -@@ -4851,3 +5996,1022 @@ interface(`dev_unconfined',` +@@ -4851,3 +6015,1022 @@ interface(`dev_unconfined',` typeattribute $1 devices_unconfined_type; ') @@ -46841,7 +47031,7 @@ index 2cea692..e3cb4f2 100644 + files_etc_filetrans($1, net_conf_t, file) +') diff --git a/policy/modules/system/sysnetwork.te b/policy/modules/system/sysnetwork.te -index a392fc4..518cf50 100644 +index a392fc4..b01eb22 100644 --- a/policy/modules/system/sysnetwork.te +++ b/policy/modules/system/sysnetwork.te @@ -5,6 +5,13 @@ policy_module(sysnetwork, 1.15.4) @@ -47240,7 +47430,7 @@ index a392fc4..518cf50 100644 ') optional_policy(` -@@ -371,3 +497,13 @@ optional_policy(` +@@ -371,3 +497,17 @@ optional_policy(` xen_append_log(ifconfig_t) xen_dontaudit_rw_unix_stream_sockets(ifconfig_t) ') @@ -47250,6 +47440,10 @@ index a392fc4..518cf50 100644 +') + +optional_policy(` ++ tlp_manage_pid_files(ifconfig_t) ++') ++ ++optional_policy(` + tunable_policy(`dhcpc_exec_iptables',` + iptables_domtrans(dhcpc_t) + ') diff --git a/policy-rawhide-contrib.patch b/policy-rawhide-contrib.patch index 811c8b8c..d5c24916 100644 --- a/policy-rawhide-contrib.patch +++ b/policy-rawhide-contrib.patch @@ -87708,7 +87708,7 @@ index c8bdea2..8ad3e01 100644 + allow $1 cluster_unit_file_t:service all_service_perms; ') diff --git a/rhcs.te b/rhcs.te -index 6cf79c4..943fd8b 100644 +index 6cf79c4..4538e45 100644 --- a/rhcs.te +++ b/rhcs.te @@ -20,6 +20,35 @@ gen_tunable(fenced_can_network_connect, false) @@ -87747,7 +87747,7 @@ index 6cf79c4..943fd8b 100644 attribute cluster_domain; attribute cluster_log; attribute cluster_pid; -@@ -44,34 +73,284 @@ type foghorn_initrc_exec_t; +@@ -44,34 +73,288 @@ type foghorn_initrc_exec_t; init_script_file(foghorn_initrc_exec_t) rhcs_domain_template(gfs_controld) @@ -87957,6 +87957,10 @@ index 6cf79c4..943fd8b 100644 +') + +optional_policy(` ++ fprintd_dbus_chat(cluster_t) ++') ++ ++optional_policy(` + ldap_systemctl(cluster_t) +') + @@ -88036,7 +88040,7 @@ index 6cf79c4..943fd8b 100644 ') ##################################### -@@ -79,13 +358,14 @@ optional_policy(` +@@ -79,13 +362,14 @@ optional_policy(` # dlm_controld local policy # @@ -88053,7 +88057,7 @@ index 6cf79c4..943fd8b 100644 kernel_rw_net_sysctls(dlm_controld_t) corecmd_exec_bin(dlm_controld_t) -@@ -98,16 +378,30 @@ fs_manage_configfs_dirs(dlm_controld_t) +@@ -98,16 +382,30 @@ fs_manage_configfs_dirs(dlm_controld_t) init_rw_script_tmp_files(dlm_controld_t) @@ -88087,7 +88091,7 @@ index 6cf79c4..943fd8b 100644 manage_files_pattern(fenced_t, fenced_lock_t, fenced_lock_t) files_lock_filetrans(fenced_t, fenced_lock_t, file) -@@ -118,9 +412,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) +@@ -118,9 +416,8 @@ files_tmp_filetrans(fenced_t, fenced_tmp_t, { file fifo_file dir }) stream_connect_pattern(fenced_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -88099,7 +88103,7 @@ index 6cf79c4..943fd8b 100644 corecmd_exec_bin(fenced_t) corecmd_exec_shell(fenced_t) -@@ -140,6 +433,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t) +@@ -140,6 +437,8 @@ corenet_udp_sendrecv_ionixnetmon_port(fenced_t) corenet_sendrecv_zented_server_packets(fenced_t) corenet_tcp_bind_zented_port(fenced_t) @@ -88108,7 +88112,7 @@ index 6cf79c4..943fd8b 100644 corenet_tcp_sendrecv_zented_port(fenced_t) corenet_sendrecv_http_client_packets(fenced_t) -@@ -148,9 +443,8 @@ corenet_tcp_sendrecv_http_port(fenced_t) +@@ -148,9 +447,8 @@ corenet_tcp_sendrecv_http_port(fenced_t) dev_read_sysfs(fenced_t) dev_read_urand(fenced_t) @@ -88120,7 +88124,7 @@ index 6cf79c4..943fd8b 100644 storage_raw_read_fixed_disk(fenced_t) storage_raw_write_fixed_disk(fenced_t) -@@ -160,7 +454,7 @@ term_getattr_pty_fs(fenced_t) +@@ -160,7 +458,7 @@ term_getattr_pty_fs(fenced_t) term_use_generic_ptys(fenced_t) term_use_ptmx(fenced_t) @@ -88129,7 +88133,7 @@ index 6cf79c4..943fd8b 100644 tunable_policy(`fenced_can_network_connect',` corenet_sendrecv_all_client_packets(fenced_t) -@@ -182,7 +476,8 @@ optional_policy(` +@@ -182,7 +480,8 @@ optional_policy(` ') optional_policy(` @@ -88139,7 +88143,7 @@ index 6cf79c4..943fd8b 100644 ') optional_policy(` -@@ -190,12 +485,17 @@ optional_policy(` +@@ -190,12 +489,17 @@ optional_policy(` ') optional_policy(` @@ -88158,7 +88162,7 @@ index 6cf79c4..943fd8b 100644 ') optional_policy(` -@@ -203,6 +503,21 @@ optional_policy(` +@@ -203,6 +507,21 @@ optional_policy(` snmp_manage_var_lib_dirs(fenced_t) ') @@ -88180,7 +88184,7 @@ index 6cf79c4..943fd8b 100644 ####################################### # # foghorn local policy -@@ -221,16 +536,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) +@@ -221,16 +540,22 @@ corenet_sendrecv_agentx_client_packets(foghorn_t) corenet_tcp_connect_agentx_port(foghorn_t) corenet_tcp_sendrecv_agentx_port(foghorn_t) @@ -88205,7 +88209,7 @@ index 6cf79c4..943fd8b 100644 snmp_stream_connect(foghorn_t) ') -@@ -247,16 +568,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ +@@ -247,16 +572,20 @@ stream_connect_pattern(gfs_controld_t, dlm_controld_var_run_t, dlm_controld_var_ stream_connect_pattern(gfs_controld_t, fenced_var_run_t, fenced_var_run_t, fenced_t) stream_connect_pattern(gfs_controld_t, groupd_var_run_t, groupd_var_run_t, groupd_t) @@ -88227,7 +88231,7 @@ index 6cf79c4..943fd8b 100644 optional_policy(` lvm_exec(gfs_controld_t) dev_rw_lvm_control(gfs_controld_t) -@@ -275,10 +600,57 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) +@@ -275,10 +604,57 @@ domtrans_pattern(groupd_t, fenced_exec_t, fenced_t) dev_list_sysfs(groupd_t) @@ -88287,7 +88291,7 @@ index 6cf79c4..943fd8b 100644 ###################################### # # qdiskd local policy -@@ -292,7 +664,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) +@@ -292,7 +668,6 @@ manage_dirs_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) manage_sock_files_pattern(qdiskd_t, qdiskd_var_lib_t, qdiskd_var_lib_t) files_var_lib_filetrans(qdiskd_t, qdiskd_var_lib_t, { file dir sock_file }) @@ -88295,7 +88299,7 @@ index 6cf79c4..943fd8b 100644 kernel_read_software_raid_state(qdiskd_t) kernel_getattr_core_if(qdiskd_t) -@@ -321,6 +692,8 @@ storage_raw_write_fixed_disk(qdiskd_t) +@@ -321,6 +696,8 @@ storage_raw_write_fixed_disk(qdiskd_t) auth_use_nsswitch(qdiskd_t) @@ -109009,6 +109013,267 @@ index 97cd155..49321a5 100644 files_search_tmp(timidity_t) fs_search_auto_mountpoints(timidity_t) +diff --git a/tlp.fc b/tlp.fc +new file mode 100644 +index 0000000..8b8cf4a +--- /dev/null ++++ b/tlp.fc +@@ -0,0 +1,5 @@ ++/usr/lib/systemd/system/((tlp-sleep.*)|(tlp.*)) -- gen_context(system_u:object_r:tlp_unit_file_t,s0) ++ ++/usr/sbin/tlp -- gen_context(system_u:object_r:tlp_exec_t,s0) ++ ++/var/run/tlp(/.*)? gen_context(system_u:object_r:tlp_var_run_t,s0) +diff --git a/tlp.if b/tlp.if +new file mode 100644 +index 0000000..46f12a4 +--- /dev/null ++++ b/tlp.if +@@ -0,0 +1,184 @@ ++ ++## policy for tlp ++ ++######################################## ++## ++## Execute tlp_exec_t in the tlp domain. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`tlp_domtrans',` ++ gen_require(` ++ type tlp_t, tlp_exec_t; ++ ') ++ ++ corecmd_search_bin($1) ++ domtrans_pattern($1, tlp_exec_t, tlp_t) ++') ++ ++###################################### ++## ++## Execute tlp in the caller domain. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`tlp_exec',` ++ gen_require(` ++ type tlp_exec_t; ++ ') ++ ++ corecmd_search_bin($1) ++ can_exec($1, tlp_exec_t) ++') ++ ++######################################## ++## ++## Search tlp conf directories. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`tlp_search_conf',` ++ gen_require(` ++ type tlp_etc_rw_t; ++ ') ++ ++ allow $1 tlp_etc_rw_t:dir search_dir_perms; ++ files_search_etc($1) ++') ++ ++######################################## ++## ++## Read tlp conf files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`tlp_read_conf_files',` ++ gen_require(` ++ type tlp_etc_rw_t; ++ ') ++ ++ allow $1 tlp_etc_rw_t:dir list_dir_perms; ++ read_files_pattern($1, tlp_etc_rw_t, tlp_etc_rw_t) ++ files_search_etc($1) ++') ++ ++######################################## ++## ++## Manage tlp conf files. ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`tlp_manage_conf_files',` ++ gen_require(` ++ type tlp_etc_rw_t; ++ ') ++ ++ manage_files_pattern($1, tlp_etc_rw_t, tlp_etc_rw_t) ++ files_search_etc($1) ++') ++ ++######################################## ++## ++## Execute tlp server in the tlp domain. ++## ++## ++## ++## Domain allowed to transition. ++## ++## ++# ++interface(`tlp_systemctl',` ++ gen_require(` ++ type tlp_t; ++ type tlp_unit_file_t; ++ ') ++ ++ systemd_exec_systemctl($1) ++ systemd_read_fifo_file_passwd_run($1) ++ allow $1 tlp_unit_file_t:file read_file_perms; ++ allow $1 tlp_unit_file_t:service manage_service_perms; ++ ++ ps_process_pattern($1, tlp_t) ++') ++ ++######################################## ++## ++## Read all dbus pid files ++## ++## ++## ++## Domain allowed access. ++## ++## ++# ++interface(`tlp_manage_pid_files',` ++ gen_require(` ++ type tlp_var_run_t; ++ ') ++ ++ files_search_pids($1) ++ read_files_pattern($1, tlp_var_run_t, tlp_var_run_t) ++') ++ ++######################################## ++## ++## All of the rules required to administrate ++## an tlp environment ++## ++## ++## ++## Domain allowed access. ++## ++## ++## ++## ++## Role allowed access. ++## ++## ++## ++# ++interface(`tlp_admin',` ++ gen_require(` ++ type tlp_t; ++ type tlp_etc_rw_t; ++ type tlp_unit_file_t; ++ ') ++ ++ allow $1 tlp_t:process { signal_perms }; ++ ps_process_pattern($1, tlp_t) ++ ++ tunable_policy(`deny_ptrace',`',` ++ allow $1 tlp_t:process ptrace; ++ ') ++ ++ files_search_etc($1) ++ admin_pattern($1, tlp_etc_rw_t) ++ ++ tlp_systemctl($1) ++ admin_pattern($1, tlp_unit_file_t) ++ allow $1 tlp_unit_file_t:service all_service_perms; ++ optional_policy(` ++ systemd_passwd_agent_exec($1) ++ systemd_read_fifo_file_passwd_run($1) ++ ') ++') +diff --git a/tlp.te b/tlp.te +new file mode 100644 +index 0000000..7c81c68 +--- /dev/null ++++ b/tlp.te +@@ -0,0 +1,54 @@ ++policy_module(tlp, 1.0.0) ++ ++######################################## ++# ++# Declarations ++# ++ ++type tlp_t; ++type tlp_exec_t; ++init_daemon_domain(tlp_t, tlp_exec_t) ++ ++type tlp_var_run_t; ++files_pid_file(tlp_var_run_t) ++ ++type tlp_unit_file_t; ++systemd_unit_file(tlp_unit_file_t) ++ ++######################################## ++# ++# tlp local policy ++# ++allow tlp_t self:capability { net_admin sys_rawio }; ++allow tlp_t self:unix_stream_socket create_stream_socket_perms; ++allow tlp_t self:udp_socket create_socket_perms; ++ ++manage_dirs_pattern(tlp_t, tlp_var_run_t, tlp_var_run_t) ++manage_files_pattern(tlp_t, tlp_var_run_t, tlp_var_run_t) ++files_pid_filetrans(tlp_t, tlp_var_run_t, { dir file }) ++ ++kernel_read_system_state(tlp_t) ++kernel_read_fs_sysctls(tlp_t) ++kernel_rw_fs_sysctls(tlp_t) ++kernel_rw_kernel_sysctl(tlp_t) ++kernel_rw_vm_sysctls(tlp_t) ++ ++auth_read_passwd(tlp_t) ++ ++corecmd_exec_bin(tlp_t) ++ ++dev_list_sysfs(tlp_t) ++dev_manage_sysfs(tlp_t) ++ ++files_read_kernel_modules(tlp_t) ++ ++modutils_exec_insmod(tlp_t) ++modutils_read_module_config(tlp_t) ++ ++storage_raw_read_fixed_disk(tlp_t) ++ ++sysnet_exec_ifconfig(tlp_t) ++ ++optional_policy(` ++ fstools_exec(tlp_t) ++') diff --git a/tmpreaper.te b/tmpreaper.te index 585a77f..a7cb326 100644 --- a/tmpreaper.te diff --git a/selinux-policy.spec b/selinux-policy.spec index 4cd8e749..0c11cd7f 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -19,7 +19,7 @@ Summary: SELinux policy configuration Name: selinux-policy Version: 3.13.1 -Release: 225%{?dist} +Release: 226%{?dist} License: GPLv2+ Group: System Environment/Base Source: serefpolicy-%{version}.tgz @@ -675,6 +675,11 @@ exit 0 %endif %changelog +* Wed Nov 16 2016 Lukas Vrabec - 3.13.1-226 +- Adding policy for tlp +- Add interface dev_manage_sysfs() +- Allow ifconfig domain to manage tlp pid files. + * Wed Nov 09 2016 Lukas Vrabec - 3.13.1-225 - Allow systemd_logind_t domain to communicate with devicekit_t domain via dbus bz(1393373)