Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9003FC43387 for ; Sat, 29 Dec 2018 15:54:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 668882145D for ; Sat, 29 Dec 2018 15:54:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726972AbeL2PyC (ORCPT ); Sat, 29 Dec 2018 10:54:02 -0500 Received: from authsmtp35.register.it ([81.88.55.98]:34115 "EHLO authsmtp.register.it" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1725862AbeL2PyC (ORCPT ); Sat, 29 Dec 2018 10:54:02 -0500 X-Greylist: delayed 304 seconds by postgrey-1.27 at vger.kernel.org; Sat, 29 Dec 2018 10:53:59 EST Received: from [192.168.1.1] ([93.41.32.9]) by cmsmtp with ESMTPSA id dGjFg1B78IPEIdGjFghwki; Sat, 29 Dec 2018 16:40:45 +0100 X-Rid: guido@trentalancia.com@93.41.32.9 Message-ID: <1546098044.20582.6.camel@trentalancia.com> Subject: [PATCH] Add sigrok contrib module From: Guido Trentalancia To: selinux-refpolicy@vger.kernel.org Date: Sat, 29 Dec 2018 16:40:44 +0100 X-Priority: 1 Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.26.2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfAD7xdTf5amanqRFMpmM3AMfwvOFISv5TAkBmIf4/TZ8OTut605NwiVsMYvwZ/b8XFVGp3WcdkH203coZliD+r92AlWRO++4/RJu2q2eCHUHTxmvH3Xw hYNd3Ahj0TSkR1gDzG7bkW0WYtH686o+pBt9D6goLbiH19VSmJQALTbh+reH5XO9ih835qtGFQ4UNA== Sender: selinux-refpolicy-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux-refpolicy@vger.kernel.org Add a SELinux Reference Policy module for the sigrok signal analysis software suite (command-line interface). Signed-off-by: Guido Trentalancia --- policy/modules/contrib/sigrok.fc | 1 policy/modules/contrib/sigrok.if | 37 +++++++++++++++++++++++++++++++++++ policy/modules/contrib/sigrok.te | 39 +++++++++++++++++++++++++++++++++++++ policy/modules/roles/unprivuser.te | 4 +++ 4 files changed, 81 insertions(+) diff -pruN a/policy/modules/contrib/sigrok.fc b/policy/modules/contrib/sigrok.fc --- a/policy/modules/contrib/sigrok.fc 1970-01-01 01:00:00.000000000 +0100 +++ b/policy/modules/contrib/sigrok.fc 2018-12-25 21:33:17.512518983 +0100 @@ -0,0 +1 @@ +/usr/bin/sigrok-cli -- gen_context(system_u:object_r:sigrok_exec_t,s0) diff -pruN a/policy/modules/contrib/sigrok.if b/policy/modules/contrib/sigrok.if --- a/policy/modules/contrib/sigrok.if 1970-01-01 01:00:00.000000000 +0100 +++ b/policy/modules/contrib/sigrok.if 2018-12-29 14:52:30.771773190 +0100 @@ -0,0 +1,37 @@ +## sigrok signal analysis software suite. + +######################################## +## +## Role access for sigrok. +## +## +## +## Role allowed access. +## +## +## +## +## User domain for the role. +## +## +# +interface(`sigrok_role',` + gen_require(` + type sigrok_t, sigrok_exec_t; + attribute_role sigrok_roles; + ') + + ######################################## + # + # Declarations + # + + roleattribute $1 sigrok_roles; + + ######################################## + # + # Policy + # + + domtrans_pattern($2, sigrok_exec_t, sigrok_t) +') diff -pruN a/policy/modules/contrib/sigrok.te b/policy/modules/contrib/sigrok.te --- a/policy/modules/contrib/sigrok.te 1970-01-01 01:00:00.000000000 +0100 +++ b/policy/modules/contrib/sigrok.te 2018-12-29 16:25:21.851742375 +0100 @@ -0,0 +1,39 @@ +policy_module(sigrok, 1.0.0) + +######################################## +# +# Declarations +# + +attribute_role sigrok_roles; +roleattribute system_r sigrok_roles; + +type sigrok_t; +type sigrok_exec_t; +userdom_user_application_domain(sigrok_t, sigrok_exec_t) +role sigrok_roles types sigrok_t; + +######################################## +# +# Local policy +# + +allow sigrok_t self:fifo_file rw_fifo_file_perms; +allow sigrok_t self:netlink_kobject_uevent_socket create_socket_perms; +allow sigrok_t self:tcp_socket create_socket_perms; + +corenet_tcp_connect_all_unreserved_ports(sigrok_t) + +dev_getattr_sysfs_dirs(sigrok_t) +dev_read_sysfs(sigrok_t) +dev_rw_generic_usb_dev(sigrok_t) + +files_read_etc_files(sigrok_t) + +term_use_unallocated_ttys(sigrok_t) + +userdom_use_user_ptys(sigrok_t) + +optional_policy(` + udev_read_pid_files(sigrok_t) +') diff -pruN a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te --- a/policy/modules/roles/unprivuser.te 2017-05-13 21:22:22.837046352 +0200 +++ b/policy/modules/roles/unprivuser.te 2018-12-28 20:07:33.588429238 +0100 @@ -146,6 +146,10 @@ ifndef(`distro_redhat',` ') optional_policy(` + sigrok_role(user_r, user_t) + ') + + optional_policy(` spamassassin_role(user_r, user_t) ')