2018-02-16 10:06:13

by Russell Coker

Subject: [refpolicy] [PATCH] udisks2 and /dev/mem version 2

Second version of this patch, it doesn't need execute access.

Index: refpolicy-2.20180216/policy/modules/contrib/devicekit.te
===================================================================
--- refpolicy-2.20180216.orig/policy/modules/contrib/devicekit.te
+++ refpolicy-2.20180216/policy/modules/contrib/devicekit.te
@@ -109,6 +109,8 @@ dev_getattr_usbfs_dirs(devicekit_disk_t)
dev_manage_generic_files(devicekit_disk_t)
dev_read_urand(devicekit_disk_t)
dev_rw_sysfs(devicekit_disk_t)
+# /dev/mem is accessed by libparted to get EFI data
+dev_read_raw_memory(devicekit_disk_t)

domain_getattr_all_pipes(devicekit_disk_t)
domain_getattr_all_sockets(devicekit_disk_t)

2018-02-18 16:14:03

by Chris PeBenito

Subject: [refpolicy] [PATCH] udisks2 and /dev/mem version 2

On 02/16/2018 05:06 AM, Russell Coker via refpolicy wrote:
> Second version of this patch, it doesn't need execute access.
>
> Index: refpolicy-2.20180216/policy/modules/contrib/devicekit.te
> ===================================================================
> --- refpolicy-2.20180216.orig/policy/modules/contrib/devicekit.te
> +++ refpolicy-2.20180216/policy/modules/contrib/devicekit.te
> @@ -109,6 +109,8 @@ dev_getattr_usbfs_dirs(devicekit_disk_t)
> dev_manage_generic_files(devicekit_disk_t)
> dev_read_urand(devicekit_disk_t)
> dev_rw_sysfs(devicekit_disk_t)
> +# /dev/mem is accessed by libparted to get EFI data
> +dev_read_raw_memory(devicekit_disk_t)
>
> domain_getattr_all_pipes(devicekit_disk_t)
> domain_getattr_all_sockets(devicekit_disk_t)

Merged, though based on the discussion about the code, I moved it to a
distro_debian block.

--
Chris PeBenito