DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DA50C214DD
From:   Dave Sugar <dsugar@tresys.com>
To:     selinux-refpolicy@vger.kernel.org
Subject: [PATCH 1/1] Add interface udev_domtrans_to
Date:   Wed, 17 Oct 2018 10:19:49 -0400
Message-Id: <20181017141949.17119-1-dsugar@tresys.com>
MIME-Version: 1.0
Content-Type: text/plain
Received-SPF: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Oct 2018 14:20:51.2102 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 1bf3499f-1195-45b3-b083-08d6343bbe2d
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR15MB1515
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

This interface is useful when using the 'RUN' option in UDEV rules where udev will be executing a user function to perform some action.  This interface allows a domain transition to occur for the run action.

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/system/udev.if | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.if
index a2067895..45ab498c 100644
--- a/policy/modules/system/udev.if
+++ b/policy/modules/system/udev.if
@@ -36,6 +36,41 @@ interface(`udev_domtrans',`
 	domtrans_pattern($1, udev_exec_t, udev_t)
 ')
 
+########################################
+## <summary>
+##	Allow udev to execute the specified program in
+##	the specified domain.
+## </summary>
+## <desc>
+##	<p>
+##	Allow udev to execute the specified program in
+##	the specified domain.
+##	</p>
+##	<p>
+##	This is an interface to support the UDEV 'RUN'
+##	command.  This will allow the command run by
+##	udev to be run in a domain other than udev_t.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain to execute in.
+##	</summary>
+## </param>
+## <param name="entry_file">
+##	<summary>
+##	Domain entry point file.
+##	</summary>
+## </param>
+#
+interface(`udev_domtrans_to',`
+	gen_require(`
+		type udev_t;
+	')
+
+	domtrans_pattern(udev_t,$2,$1)
+')
+
 ########################################
 ## <summary>
 ##	Execute udev in the caller domain.
-- 
2.14.4