Subject: Re: [PATCH] Allow map permission when reading hwdb
To:     "Sugar, David" <dsugar@tresys.com>,
        "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
References: <20190306190618.9089-1-dsugar@tresys.com>
 <20190306190618.9089-2-dsugar@tresys.com>
From:   Chris PeBenito <pebenito@ieee.org>
Message-ID: <3ccf4761-a63a-f8f1-c52d-73c797892f8e@ieee.org>
Date:   Thu, 7 Mar 2019 18:56:01 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <20190306190618.9089-2-dsugar@tresys.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk

On 3/6/19 2:07 PM, Sugar, David wrote:
> I'm seeing a denial for udev to map /etc/udev/hwdb.bin.
> This updates the existing interface to include allowing
> to map the file.
> 
> type=AVC msg=audit(1551886176.948:642): avc:  denied  { map } for  pid=5187 comm="systemd-udevd" path="/etc/udev/hwdb.bin" dev="dm-1" ino=6509618 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_hwdb_t:s0 tclass=file permissive=1
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/system/systemd.if | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
> index 8d2bb8da..03d83dc7 100644
> --- a/policy/modules/system/systemd.if
> +++ b/policy/modules/system/systemd.if
> @@ -34,7 +34,7 @@ interface(`systemd_read_hwdb',`
>   		type systemd_hwdb_t;
>   	')
>   
> -	read_files_pattern($1, systemd_hwdb_t, systemd_hwdb_t)
> +	mmap_read_files_pattern($1, systemd_hwdb_t, systemd_hwdb_t)
>   ')
>   
>   ######################################

This should be a new interface.

-- 
Chris PeBenito