From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Sat, 17 Aug 2013 20:51:43 +0200 Subject: [refpolicy] [PATCH 4/7] The security_t file system can be at /sys/fs/selinux In-Reply-To: <1376765506-28924-1-git-send-email-sven.vermeulen@siphos.be> References: <1376765506-28924-1-git-send-email-sven.vermeulen@siphos.be> Message-ID: <1376765506-28924-5-git-send-email-sven.vermeulen@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Because it is no longer a top-level file system, we need to enhance some of the interfaces with the appropriate rights towards sysfs_t. First set to allow getattr rights on the file system, which now also means getattr on the sysfs_t file system as well as search privileges in sysfs_t. Signed-off-by: Sven Vermeulen --- policy/modules/kernel/devices.if | 18 ++++++++++++++++++ policy/modules/kernel/selinux.if | 4 ++++ 2 files changed, 22 insertions(+) diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index 49f0acb..a0a2a0d 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -3855,6 +3855,24 @@ interface(`dev_getattr_sysfs_dirs',` ######################################## ## +## Get the attributes of sysfs filesystem +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_getattr_sysfs_fs',` + gen_require(` + type sysfs_t; + ') + + allow $1 sysfs_t:filesystem getattr; +') + +######################################## +## ## Search the sysfs directories. ## ## diff --git a/policy/modules/kernel/selinux.if b/policy/modules/kernel/selinux.if index 81440c5..9623a80 100644 --- a/policy/modules/kernel/selinux.if +++ b/policy/modules/kernel/selinux.if @@ -63,6 +63,10 @@ interface(`selinux_get_fs_mount',` # (/selinux) is already a selinuxfs allow $1 security_t:filesystem getattr; + # Same for /sys/fs/selinux + dev_getattr_sysfs_fs($1) + dev_search_sysfs($1) + # read /proc/filesystems to see if selinuxfs is supported # then read /proc/self/mount to see where selinuxfs is mounted kernel_read_system_state($1) -- 1.8.1.5