rpms/swtpm
5
0
Fork 0
Code Issues Pull Requests Releases Activity

Add extra SELinux permissions

Browse Source 
https://issues.redhat.com/browse/RHEL-70835
https://issues.redhat.com/browse/RHEL-73809

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
This commit is contained in:
Marc-André Lureau 2025-01-14 11:21:49 +04:00
parent d26797bfd6
commit 8b3d376f34
2 changed files with 38 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
selinux.patch
View File

@ -1,18 +1,32 @@
From b5276c6f67c17ab5636f787c5a2177f77594fa2b Mon Sep 17 00:00:00 2001 From 816c9ef66eaec230f9dd89e1deebfadc7359aa60 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com> From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 13 Jul 2024 13:37:29 +0400 Date: Sat, 13 Jul 2024 13:37:29 +0400
Subject: [PATCH] selinux Subject: [PATCH] selinux
--- ---
src/selinux/swtpm.te | 1 + src/selinux/swtpm.te | 12 +++++++++++-
src/selinux/swtpm_svirt.te | 4 ++++ src/selinux/swtpm_svirt.te | 4 ++++
2 files changed, 5 insertions(+) 2 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/src/selinux/swtpm.te b/src/selinux/swtpm.te diff --git a/src/selinux/swtpm.te b/src/selinux/swtpm.te
index 2327721..f1c6867 100644 index 2327721..c35056e 100644
--- a/src/selinux/swtpm.te --- a/src/selinux/swtpm.te
+++ b/src/selinux/swtpm.te +++ b/src/selinux/swtpm.te
@@ -34,6 +34,7 @@ allow swtpm_t virt_var_lib_t:file { create rename setattr unlink write }; @@ -11,6 +11,8 @@ require {
type virt_var_lib_t;
type virtqemud_t;
type virtqemud_tmp_t;
+ class file map;
+ tunable virt_use_nfs;
}
attribute_role swtpm_roles;
@@ -30,10 +32,11 @@ allow swtpm_t qemu_var_run_t:dir { add_name remove_name write };
allow swtpm_t qemu_var_run_t:sock_file { create setattr unlink };
allow swtpm_t var_log_t:file open;
allow swtpm_t virt_var_lib_t:dir { add_name remove_name write };
-allow swtpm_t virt_var_lib_t:file { create rename setattr unlink write };
+allow swtpm_t virt_var_lib_t:file { create rename setattr unlink write map };
allow swtpm_t virtqemud_t:unix_stream_socket { read write getattr }; allow swtpm_t virtqemud_t:unix_stream_socket { read write getattr };
allow swtpm_t virtqemud_tmp_t:file { open write }; allow swtpm_t virtqemud_tmp_t:file { open write };
@ -20,6 +34,17 @@ index 2327721..f1c6867 100644
domain_use_interactive_fds(swtpm_t) domain_use_interactive_fds(swtpm_t)
@@ -42,3 +45,10 @@ files_read_etc_files(swtpm_t)
auth_use_nsswitch(swtpm_t)
miscfiles_read_localization(swtpm_t)
+
+tunable_policy(`virt_use_nfs',`
+ fs_manage_nfs_dirs(swtpm_t)
+ fs_manage_nfs_files(swtpm_t)
+ fs_read_nfs_symlinks(swtpm_t)
+ fs_mmap_nfs_files(swtpm_t)
+')
diff --git a/src/selinux/swtpm_svirt.te b/src/selinux/swtpm_svirt.te diff --git a/src/selinux/swtpm_svirt.te b/src/selinux/swtpm_svirt.te
index f7b886c..424efa7 100644 index f7b886c..424efa7 100644
--- a/src/selinux/swtpm_svirt.te --- a/src/selinux/swtpm_svirt.te

8
swtpm.spec
View File

@ -8,7 +8,7 @@
Summary: TPM Emulator Summary: TPM Emulator
Name: swtpm Name: swtpm
Version: 0.9.0 Version: 0.9.0
Release: 4%{?dist} Release: 5%{?dist}
License: BSD-3-Clause License: BSD-3-Clause
Url: https://github.com/stefanberger/swtpm Url: https://github.com/stefanberger/swtpm
Source0: https://github.com/stefanberger/swtpm/archive/v%{version}/%{name}-%{version}.tar.gz Source0: https://github.com/stefanberger/swtpm/archive/v%{version}/%{name}-%{version}.tar.gz
@ -202,6 +202,12 @@ fi
%{_datadir}/swtpm/swtpm-create-tpmca %{_datadir}/swtpm/swtpm-create-tpmca
%changelog %changelog
* Tue Jan 14 2025 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.0-5
- Add extra SELinux policies.
https://github.com/stefanberger/swtpm/issues/970
Resolves: RHEL-70835
Resolves: RHEL-73809
* Mon Nov 04 2024 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.0-4 * Mon Nov 04 2024 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.0-4
- Add extra SELinux policies. - Add extra SELinux policies.
Related: RHEL-53967 Related: RHEL-53967