Received-SPF: pass (google.com: best guess record for domain of selinux-refpolicy-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Sugar, David" <dsugar@tresys.com>
To:     "selinux-refpolicy@vger.kernel.org" 
        <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH] Module for tpm2-abrmd
Thread-Topic: [PATCH] Module for tpm2-abrmd
Thread-Index: AQHVQvdexNgiDCQ3ZU2sLeCfWxr+tQ==
Date:   Thu, 25 Jul 2019 14:43:48 +0000
Message-ID: <20190725144316.10409-1-dsugar@tresys.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.21.0
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 3c69e803-9d70-43a0-99cf-08d7110e80b8
x-microsoft-antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020);SRVR:BN6PR15MB1698;
x-ms-traffictypediagnostic: BN6PR15MB1698:
x-microsoft-antispam-prvs: <BN6PR15MB16983B353C3A548127ADDAA6B9C10@BN6PR15MB1698.namprd15.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:126;
x-forefront-prvs: 0109D382B0
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(4636009)(39830400003)(376002)(136003)(396003)(366004)(346002)(199004)(189003)(99286004)(6116002)(14454004)(36756003)(71200400001)(2501003)(316002)(6916009)(2906002)(305945005)(5660300002)(68736007)(71190400001)(7736002)(3846002)(2616005)(8676002)(2351001)(6506007)(66066001)(476003)(52116002)(1076003)(6486002)(50226002)(186003)(486006)(86362001)(64756008)(6436002)(26005)(66476007)(25786009)(102836004)(386003)(66446008)(66946007)(66556008)(14444005)(8936002)(6512007)(256004)(5640700003)(53936002)(81166006)(81156014)(508600001);DIR:OUT;SFP:1102;SCL:1;SRVR:BN6PR15MB1698;H:BN6PR15MB1507.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: tresys.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: yhJF+jQnmVz42PCz9vhLk20UsattGZgUpoTTReXATvYqi6Tbwsj1+gIvSWeXIN56YWsP6u230PsS6pD8RL+AvI3z4KG/I5E6W1J+qLE35B7hdxR9xvHJLcs0xQLCXcHXCwpTxb+vLhi/fJx5HHiiKtO8LXLMxV5GS+b7yYYzQI8V/TrKgbFTY469qj2KCdrSH1ydcBXCjCnaltqY9wPBuwYAAsHs+z/fGmuIO/8eg2r8lENlsZWq0Y9MWh+oGTJxhk1C3jor3HdT8qwVR1ruqFn4iMIuf8ohq5RZV22EWSZiGup8sMts/EM/km+GGNp5vqheRyJpFU8r46PJ7MZDQO8fcrhuakjTP1OPP2GVP42tvAPFen5+f4P1Anub2bpr4enY3gL0L53ipYsdhPFlzs6bn+5d/NmLS36NQO4AGLs=
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: tresys.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3c69e803-9d70-43a0-99cf-08d7110e80b8
X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Jul 2019 14:43:48.7148
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a0d45667-6c07-4e88-868f-4ac9af95c7ed
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: dsugar@tresys.com
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR15MB1698
Sender: selinux-refpolicy-owner@vger.kernel.org
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
 policy/modules/services/tpm2_abrmd.fc |  3 ++
 policy/modules/services/tpm2_abrmd.if | 58 +++++++++++++++++++++++++++
 policy/modules/services/tpm2_abrmd.te | 29 ++++++++++++++
 3 files changed, 90 insertions(+)
 create mode 100644 policy/modules/services/tpm2_abrmd.fc
 create mode 100644 policy/modules/services/tpm2_abrmd.if
 create mode 100644 policy/modules/services/tpm2_abrmd.te

diff --git a/policy/modules/services/tpm2_abrmd.fc b/policy/modules/service=
s/tpm2_abrmd.fc
new file mode 100644
index 00000000..4ccf2f25
--- /dev/null
+++ b/policy/modules/services/tpm2_abrmd.fc
@@ -0,0 +1,3 @@
+/usr/sbin/tpm2-abrmd								--	gen_context(system_u:object_r:tpm2_abrmd_ex=
ec_t,s0)
+
+/usr/lib/systemd/system/[^/]*tpm2-abrmd\.service	--	gen_context(system_u:o=
bject_r:tpm2_abrmd_unit_t,s0)
diff --git a/policy/modules/services/tpm2_abrmd.if b/policy/modules/service=
s/tpm2_abrmd.if
new file mode 100644
index 00000000..dabb4a65
--- /dev/null
+++ b/policy/modules/services/tpm2_abrmd.if
@@ -0,0 +1,58 @@
+## <summary>TPM2 Access Broker and Resource Management daemon.</summary>
+
+########################################
+## <summary>
+##	Allow specified domain to enable/disable tpm2-abrmd unit
+## </summary>
+## <param name=3D"domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`tpm2_abrmd_enabledisable',`
+	gen_require(`
+		type tpm2_abrmd_unit_t;
+		class service { enable disable };
+	')
+
+	allow $1 tpm2_abrmd_unit_t:service { enable disable };
+')
+
+########################################
+## <summary>
+##	Allow specified domain to start/stop tpm2-abrmd unit
+## </summary>
+## <param name=3D"domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`tpm2_abrmd_startstop',`
+	gen_require(`
+		type tpm2_abrmd_unit_t;
+		class service { start stop };
+	')
+
+	allow $1 tpm2_abrmd_unit_t:service { start stop };
+')
+
+########################################
+## <summary>
+##	Allow specified domain to get status of tpm2-abrmd unit
+## </summary>
+## <param name=3D"domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`tpm2_abrmd_status',`
+	gen_require(`
+		type tpm2_abrmd_unit_t;
+		class service status;
+	')
+
+	allow $1 tpm2_abrmd_unit_t:service status;
+')
diff --git a/policy/modules/services/tpm2_abrmd.te b/policy/modules/service=
s/tpm2_abrmd.te
new file mode 100644
index 00000000..8a8ba5f0
--- /dev/null
+++ b/policy/modules/services/tpm2_abrmd.te
@@ -0,0 +1,29 @@
+policy_module(tpm2_abrmd, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type tpm2_abrmd_t;
+type tpm2_abrmd_exec_t;
+init_daemon_domain(tpm2_abrmd_t, tpm2_abrmd_exec_t)
+
+type tpm2_abrmd_unit_t;
+init_unit_file(tpm2_abrmd_unit_t)
+
+########################################
+#
+# Local policy
+#
+
+allow tpm2_abrmd_t self:process signal;
+allow tpm2_abrmd_t self:unix_stream_socket create_socket_perms;
+
+dev_rw_tpm(tpm2_abrmd_t)
+
+kernel_read_crypto_sysctls(tpm2_abrmd_t)
+kernel_read_system_state(tpm2_abrmd_t)
+
+dbus_system_bus_client(tpm2_abrmd_t)
+dbus_connect_system_bus(tpm2_abrmd_t)
--=20
2.21.0