From:   "Sugar, David" <dsugar@tresys.com>
To:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH] Add interface to run cdrecord in caller domain
Thread-Topic: [PATCH] Add interface to run cdrecord in caller domain
Thread-Index: AQHUx8SZeITFZe9i8kCyrVvypcJb1g==
Date:   Mon, 18 Feb 2019 20:00:30 +0000
Message-ID: <20190218200017.4439-2-dsugar@tresys.com>
References: <20190218200017.4439-1-dsugar@tresys.com>
In-Reply-To: <20190218200017.4439-1-dsugar@tresys.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.20.1
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: b8548550-d065-4c50-42c0-08d695dbbba0
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600110)(711020)(4605104)(2017052603328)(7153060)(7193020);SRVR:CY4PR15MB1574;
x-ms-traffictypediagnostic: CY4PR15MB1574:
x-microsoft-exchange-diagnostics: =?iso-8859-1?Q?1;CY4PR15MB1574;23:K05WXUUlJJwg1AWa4dbWOnubnGhlBA39fEEWUMh?=
 =?iso-8859-1?Q?4c0y0vrRWTpEr4FuSzjc3ag/Tl6TXl8PnMgMkSlXYQDie3BCcMOXHA53kq?=
 =?iso-8859-1?Q?AqnfMg46gzczcIX4RjgqR/DCsaxngGkbyXciOEOWLTQrIuTmtHzCOfjVug?=
 =?iso-8859-1?Q?SHtpWFHOAERzo99xCMx+aRy4yP+h4p6GbXDUwilAa3XsyKm34+05bSDCqf?=
 =?iso-8859-1?Q?uRvVNGt3mBwVZElYu6bfJmakAMW27y9z9lHsNVR/c29c0MjqcUJsMSmvQi?=
 =?iso-8859-1?Q?CJ6F61LvFx+Tr/mZq3CdBQKEECSsRDFNLTMrbQATxsqrkulgOIk1Km+mOO?=
 =?iso-8859-1?Q?pydpEOSEvm5c2eyoIERMUQbyIRKD3Fq+6rW5eyUUllkahhnsgsdGY8ZOan?=
 =?iso-8859-1?Q?091OIOdDi7ZVSfCIvnqW4GDNf8DSGYZ5ChExOrwVXlb2Q3xqxn1kHyS1Dc?=
 =?iso-8859-1?Q?ZZxTrSmUy2t/f8g/ZZY5T/GwJ8r/MMYBNiFVhaDc4FwBnAKNbrL6cc648G?=
 =?iso-8859-1?Q?FeFtR1yMt8UQacSyW7w8r8LhP4fEq8yefL0hkbWnz7IqqWKaN9W7skpaIM?=
 =?iso-8859-1?Q?Ham2iXgWHF7biU7ec07azhrQ2+k6V3V//wMMTsGauepS5lYYK/xGWbegE2?=
 =?iso-8859-1?Q?p15ZUVYofp5DE7WJo0+KK13SHtaR7l4Type1OWeGLSQEEWtA6EokMvbVBh?=
 =?iso-8859-1?Q?nLlS1FvDpEiwxXy40blRtNzB3fIYq31F2nL2R1dUKNkkpPbU59lah+ERd5?=
 =?iso-8859-1?Q?dhZ0X668mhEC7iEUI5S90yyKhuppMHAximGNkpxj80x6qHBPzRDfaKrXIk?=
 =?iso-8859-1?Q?lRPgIJCXCkcJ8CJhpUbxG7x5MXShfNA9SXHzfDsEVg5Vy1xHbIWyJ/Bd41?=
 =?iso-8859-1?Q?t9CI5T50QLiqWg/2hY69jedMBXa51n28OXeT/qIN+bolpB6L4kTranVB5A?=
 =?iso-8859-1?Q?oeAb3Tvo8NQ9YV2x0WDQw6gKmUs7kvhEJioA1o5TJ/Eya1zWZksNJ6ti+I?=
 =?iso-8859-1?Q?yO9Y9fCvsN0V1EtYrwHZwKf1AzbqulUmaUpxZaqlrPO4I1HSkxjffl2LC6?=
 =?iso-8859-1?Q?ViawEc+GgZxeSo2ZZ3smsxuvTg24hzhmqhfgR/urRUNJLR8MGMRnpA3BPE?=
 =?iso-8859-1?Q?qz+MHRkt4RKoNW30jrICnjVyDPhlciU9ymG7B1AedxPeGDqrryya0jE/Hj?=
 =?iso-8859-1?Q?i6sgU1aniFibh/4BbY8YqURJ9lN5jXWpJTJ4PUT5XVE//CU5pIs78/OY9C?=
 =?iso-8859-1?Q?8/ps6pHq6YSUnGF25i8yA9XeLdjbgQs0dIpL9Qu7qakV9MF5YdiZD9999a?=
 =?iso-8859-1?Q?njCyyrASM8T4CCHfuNiOn3o?=
x-microsoft-antispam-prvs: <CY4PR15MB1574F8F5A8AC560FD87B3C98B9630@CY4PR15MB1574.namprd15.prod.outlook.com>
x-forefront-prvs: 09525C61DB
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(346002)(376002)(136003)(396003)(366004)(39830400003)(189003)(199004)(1076003)(5660300002)(81166006)(6506007)(8676002)(25786009)(6916009)(386003)(8936002)(81156014)(52116002)(14444005)(256004)(316002)(97736004)(53936002)(102836004)(76176011)(5640700003)(26005)(68736007)(6436002)(486006)(2351001)(2616005)(2906002)(508600001)(476003)(305945005)(3846002)(446003)(6116002)(7736002)(50226002)(11346002)(106356001)(99286004)(86362001)(6512007)(71190400001)(36756003)(66066001)(4744005)(105586002)(71200400001)(14454004)(6486002)(186003)(2501003);DIR:OUT;SFP:1102;SCL:1;SRVR:CY4PR15MB1574;H:CY4PR15MB1509.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: Km/le2cOUi52p+bvTWY6o1m5bqs+3RPOwlBrDBoRVndk5wli6uKaJOpB2t5xxkPcqfd5z8R5SWxO1iTLWwIjTZSfkOk04DJllvckI0sWXF4XE8BkrHPnCHP6YceIUz0BsNp6XCo6mXnNEP+aQk0P3tDaP/5ImdlwNCMBHXeTBMKoJbCJ0ua78JOpMUuK84lGhIsus/MUbwf/nToOLffMcirD4JyBwYuG5MAavL08RFi+ieZUS34+q0oja1HwAzeaO+cyAP9qARXSIJzz9EknRRmBORMfx+m2jRH6Z8VmFZjWTW6B14F5P7fmZqotKCOlkGVIQlJcgSNDxXltb+AG64Nubl5F1OAGhqQvhxQDoYgVH78ag7KexZRzXYc5/B6ybOIRYfR6UYP/KfMY1+zUEICauXOTFd9A1PwLbSGKkvU=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: tresys.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b8548550-d065-4c50-42c0-08d695dbbba0
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Feb 2019 20:00:29.5690
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR15MB1574
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/apps/cdrecord.if | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/policy/modules/apps/cdrecord.if b/policy/modules/apps/cdrecord=
.if
index fbc20f69..ba81fb1a 100644
--- a/policy/modules/apps/cdrecord.if
+++ b/policy/modules/apps/cdrecord.if
@@ -30,3 +30,22 @@ interface(`cdrecord_role',`
 	allow $2 cdrecord_t:process { ptrace signal_perms };
 	ps_process_pattern($2, cdrecord_t)
 ')
+
+########################################
+## <summary>
+##	Execute cdrecord in the caller domain.
+## </summary>
+## <param name=3D"domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cdrecord_exec',`
+	gen_require(`
+		type cdrecord_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	can_exec($1, cdrecord_exec_t)
+')
--=20
2.20.1