From: aranea@aixah.de (Luis Ressel) Date: Sun, 16 Feb 2014 17:34:37 +0100 Subject: [refpolicy] [PATCH 3/3] Add neccessary permissions for losetup In-Reply-To: <1392568477-15921-1-git-send-email-aranea@aixah.de> References: <1392568477-15921-1-git-send-email-aranea@aixah.de> Message-ID: <1392568477-15921-4-git-send-email-aranea@aixah.de> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com This allows losetup to bind mount_loopback_t files to loop devices. --- policy/modules/kernel/kernel.te | 2 ++ policy/modules/system/fstools.te | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 7f7372f..cdea637 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -317,6 +317,8 @@ optional_policy(` ') optional_policy(` + # loop devices + fsadm_use_fds(kernel_t) mount_use_fds(kernel_t) mount_read_loopback_files(kernel_t) ') diff --git a/policy/modules/system/fstools.te b/policy/modules/system/fstools.te index 653d0b9..8c751f5 100644 --- a/policy/modules/system/fstools.te +++ b/policy/modules/system/fstools.te @@ -53,6 +53,10 @@ logging_log_filetrans(fsadm_t, fsadm_log_t, file) # Enable swapping to files allow fsadm_t swapfile_t:file { rw_file_perms swapon }; +# losetup: bind mount_loopback_t files to loop devices +dev_rw_loop_control(fsadm_t) +mount_rw_loopback_files(fsadm_t) + kernel_read_system_state(fsadm_t) kernel_read_kernel_sysctls(fsadm_t) kernel_request_load_module(fsadm_t) -- 1.8.5.5