rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

smartmon patch from Dan Walsh.

Browse Source
This commit is contained in:
Chris PeBenito 2009-12-18 10:33:50 -05:00
parent 3fe6f6ad60
commit b84d6ec491
5 changed files with 88 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
policy/modules/kernel/devices.if
View File

@ -145,6 +145,24 @@ interface(`dev_add_entry_generic_dirs',`
allow $1 device_t:dir add_entry_dir_perms;
')
########################################
## <summary>
## Add entries to directories in /dev.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to add entries.
## </summary>
## </param>
#
interface(`dev_remove_entry_generic_dirs',`
gen_require(`
type device_t;
')
allow $1 device_t:dir del_entry_dir_perms;
')
########################################
## <summary>
## Create a directory in the device directory.

2
policy/modules/kernel/devices.te
View File

@ -1,5 +1,5 @@
policy_module(devices, 1.9.1)
policy_module(devices, 1.9.2)
########################################
#

38
policy/modules/kernel/storage.if
View File

@ -188,6 +188,44 @@ interface(`storage_raw_rw_fixed_disk',`
storage_raw_write_fixed_disk($1)
')
########################################
## <summary>
## Allow the caller to create fixed disk device nodes.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`storage_create_fixed_disk_dev',`
gen_require(`
type fixed_disk_device_t;
')
allow $1 fixed_disk_device_t:blk_file create_blk_file_perms;
dev_add_entry_generic_dirs($1)
')
########################################
## <summary>
## Allow the caller to create fixed disk device nodes.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`storage_delete_fixed_disk_dev',`
gen_require(`
type fixed_disk_device_t;
')
allow $1 fixed_disk_device_t:blk_file delete_blk_file_perms;
dev_remove_entry_generic_dirs($1)
')
########################################
## <summary>
## Create, read, write, and delete fixed disk device nodes.

2
policy/modules/kernel/storage.te
View File

@ -1,5 +1,5 @@
policy_module(storage, 1.7.1)
policy_module(storage, 1.7.2)
########################################
#

37
policy/modules/services/smartmon.te
View File

@ -1,11 +1,19 @@
policy_module(smartmon, 1.9.0)
policy_module(smartmon, 1.9.1)
########################################
#
# Declarations
#
## <desc>
## <p>
## Enable additional permissions needed to support
## devices on 3ware controllers.
## </p>
## </desc>
gen_tunable(smartmon_3ware, false)
type fsdaemon_t;
type fsdaemon_exec_t;
init_daemon_domain(fsdaemon_t, fsdaemon_exec_t)
@ -19,14 +27,18 @@ files_pid_file(fsdaemon_var_run_t)
type fsdaemon_tmp_t;
files_tmp_file(fsdaemon_tmp_t)
ifdef(`enable_mls',`
init_ranged_daemon_domain(fsdaemon_t, fsdaemon_exec_t, mls_systemhigh)
')
########################################
#
# Local policy
#
allow fsdaemon_t self:capability { setgid sys_rawio sys_admin };
allow fsdaemon_t self:capability { setpcap setgid sys_rawio sys_admin };
dontaudit fsdaemon_t self:capability sys_tty_config;
allow fsdaemon_t self:process signal_perms;
allow fsdaemon_t self:process { getcap setcap signal_perms };
allow fsdaemon_t self:fifo_file rw_fifo_file_perms;
allow fsdaemon_t self:unix_dgram_socket create_socket_perms;
allow fsdaemon_t self:unix_stream_socket create_stream_socket_perms;
@ -66,6 +78,7 @@ fs_getattr_all_fs(fsdaemon_t)
fs_search_auto_mountpoints(fsdaemon_t)
mls_file_read_all_levels(fsdaemon_t)
#mls_rangetrans_target(fsdaemon_t)
storage_raw_read_fixed_disk(fsdaemon_t)
storage_raw_write_fixed_disk(fsdaemon_t)
@ -80,19 +93,29 @@ logging_send_syslog_msg(fsdaemon_t)
miscfiles_read_localization(fsdaemon_t)
seutil_sigchld_newrole(fsdaemon_t)
sysnet_dns_name_resolve(fsdaemon_t)
userdom_dontaudit_use_unpriv_user_fds(fsdaemon_t)
userdom_dontaudit_search_user_home_dirs(fsdaemon_t)
tunable_policy(`smartmon_3ware',`
allow fsdaemon_t self:process setfscreate;
storage_create_fixed_disk_dev(fsdaemon_t)
storage_delete_fixed_disk_dev(fsdaemon_t)
storage_dev_filetrans_fixed_disk(fsdaemon_t)
selinux_validate_context(fsdaemon_t)
seutil_read_file_contexts(fsdaemon_t)
')
optional_policy(`
mta_send_mail(fsdaemon_t)
')
optional_policy(`
seutil_sigchld_newrole(fsdaemon_t)
')
optional_policy(`
udev_read_db(fsdaemon_t)
')