2013-12-16 16:08:18

by Laurent Bigonville

Subject: [refpolicy] [PATCH 1/2] Label /bin/fusermount like /usr/bin/fusermount

From: Laurent Bigonville <[email protected]>

On Debian, fusermount is installed under that path
---
policy/modules/system/mount.fc | 1 +
1 file changed, 1 insertion(+)

diff --git a/policy/modules/system/mount.fc b/policy/modules/system/mount.fc
index a38605e..4619000 100644
--- a/policy/modules/system/mount.fc
+++ b/policy/modules/system/mount.fc
@@ -1,3 +1,4 @@
+/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)

--
1.8.5.1

2013-12-16 16:08:19

by Laurent Bigonville

Subject: [refpolicy] [PATCH 2/2] Allow udev to write in /etc/udev/rules.d

From: Laurent Bigonville <[email protected]>

Udev is writing persistent rules in /etc/udev/rules.d to ensure the
network interfaces and storage devices have a persistent name.

This patch has been taken from the Fedora policy
---
policy/modules/system/udev.te | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index 1643ae0..bcb4bd9 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -68,7 +68,8 @@ allow udev_t udev_tbl_t:file manage_file_perms;
dev_filetrans(udev_t, udev_tbl_t, file)

list_dirs_pattern(udev_t, udev_rules_t, udev_rules_t)
-read_files_pattern(udev_t, udev_rules_t, udev_rules_t)
+manage_files_pattern(udev_t, udev_rules_t, udev_rules_t)
+manage_lnk_files_pattern(udev_t, udev_rules_t, udev_rules_t)

manage_dirs_pattern(udev_t, udev_var_run_t, udev_var_run_t)
manage_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)
--
1.8.5.1

2013-12-20 20:18:51

by cpebenito

Subject: [refpolicy] [PATCH 2/2] Allow udev to write in /etc/udev/rules.d

On 12/16/13 11:08, Laurent Bigonville wrote:
> From: Laurent Bigonville <[email protected]>
>
> Udev is writing persistent rules in /etc/udev/rules.d to ensure the
> network interfaces and storage devices have a persistent name.
>
> This patch has been taken from the Fedora policy
> ---
> policy/modules/system/udev.te | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
> index 1643ae0..bcb4bd9 100644
> --- a/policy/modules/system/udev.te
> +++ b/policy/modules/system/udev.te
> @@ -68,7 +68,8 @@ allow udev_t udev_tbl_t:file manage_file_perms;
> dev_filetrans(udev_t, udev_tbl_t, file)
>
> list_dirs_pattern(udev_t, udev_rules_t, udev_rules_t)
> -read_files_pattern(udev_t, udev_rules_t, udev_rules_t)
> +manage_files_pattern(udev_t, udev_rules_t, udev_rules_t)
> +manage_lnk_files_pattern(udev_t, udev_rules_t, udev_rules_t)
>
> manage_dirs_pattern(udev_t, udev_var_run_t, udev_var_run_t)
> manage_files_pattern(udev_t, udev_var_run_t, udev_var_run_t)

Merged.

--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com