Message-ID: <d6e3169bf77b4257f96d24e8d75494778b1956ca.camel@ieee.org>
Subject: Re: [PATCH] Allow AIDE to mmap files
From:   Chris PeBenito <pebenito@ieee.org>
To:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Date:   Tue, 26 Feb 2019 19:22:26 -0800
In-Reply-To: <20190225233708.15319-6-dsugar@tresys.com>
References: <20190225233708.15319-1-dsugar@tresys.com>
         <20190225233708.15319-6-dsugar@tresys.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.30.5 (3.30.5-1.fc29) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On Mon, 2019-02-25 at 23:37 +0000, Sugar, David wrote:
> AIDE has a compile time option WITH_MMAP which allows AIDE to
> map files during scanning.  RHEL7 has set this option in the
> aide rpm they distribute.
> 
> Changes made to add a tunable to enable permissions allowing
> aide to map files that it needs.  I have set the default to
> false as this seems perfered (in my mind).
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>  policy/modules/admin/aide.te | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/policy/modules/admin/aide.te
> b/policy/modules/admin/aide.te
> index f58ba850..fe52a280 100644
> --- a/policy/modules/admin/aide.te
> +++ b/policy/modules/admin/aide.te
> @@ -5,6 +5,15 @@ policy_module(aide, 1.8.0)
>  # Declarations
>  #
>  
> +## <desc>
> +##	<p>
> +##	Control if AIDE can mmap files.
> +##	AIDE can be compiled with the option 'with-mmap' in which case
> it will
> +## 	attempt to mmap files while running.
> +##	</p>
> +## </desc>
> +gen_tunable(aide_mmap_files, false)
> +
>  attribute_role aide_roles;
>  
>  type aide_t;
> @@ -43,6 +52,10 @@ logging_send_syslog_msg(aide_t)
>  
>  userdom_use_user_terminals(aide_t)
>  
> +tunable_policy(`aide_mmap_files',`
> +	files_map_non_auth_files(aide_t)
> +')
> +
>  optional_policy(`
>  	seutil_use_newrole_fds(aide_t)
>  ')

Merged.

-- 
Chris PeBenito