Subject: Re: [PATCH v2] Add interface udev_run
To:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
References: <20190306190618.9089-1-dsugar@tresys.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <ff88307d-bae7-7c9c-5ca9-25b37ac30b65@ieee.org>
Date:   Thu, 7 Mar 2019 18:55:54 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <20190306190618.9089-1-dsugar@tresys.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 3/6/19 2:07 PM, Sugar, David wrote:
> Altered to use roleattribute based on suggestion
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/system/udev.if | 26 ++++++++++++++++++++++++++
>   policy/modules/system/udev.te |  2 ++
>   2 files changed, 28 insertions(+)
> 
> diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.if
> index fee55852..90dfb17d 100644
> --- a/policy/modules/system/udev.if
> +++ b/policy/modules/system/udev.if
> @@ -36,6 +36,32 @@ interface(`udev_domtrans',`
>   	domtrans_pattern($1, udev_exec_t, udev_t)
>   ')
>   
> +########################################
> +## <summary>
> +##	Execute udev in the udev domain, and
> +##	allow the specified role the udev domain.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed to transition.
> +##	</summary>
> +## </param>
> +## <param name="role">
> +##	<summary>
> +##	Role allowed access.
> +##	</summary>
> +## </param>
> +## <rolecap/>
> +#
> +interface(`udev_run',`
> +	gen_require(`
> +		attribute_role udev_roles;
> +	')
> +
> +	udev_domtrans($1)
> +	roleattribute $2 udev_roles;
> +')

Why is a user be starting this?


-- 
Chris PeBenito