From: jason@perfinion.com (Jason Zaman)
Date: Sat, 11 Jul 2015 13:16:42 +0400
Subject: [refpolicy] [PATCH 1/2] virt: virtlockd fcontext and re-exec perm
Message-ID: <1436606203-7027-1-git-send-email-jason@perfinion.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

virtlockd can re-exec itself to upgrade and keep its locks open.

path="/usr/sbin/virtlockd" dev="zfs" ino=153197
scontext=system_u:system_r:virtd_t
tcontext=system_u:object_r:virtd_exec_t tclass=file
---
 virt.fc | 1 +
 virt.te | 1 +
 2 files changed, 2 insertions(+)

diff --git a/virt.fc b/virt.fc
index b38007b..a2facc9 100644
--- a/virt.fc
+++ b/virt.fc
@@ -27,6 +27,7 @@ HOME_DIR/VirtualMachines/isos(/.*)?	gen_context(system_u:object_r:virt_content_t
 /usr/sbin/fence_virtd	--	gen_context(system_u:object_r:virsh_exec_t,s0)
 /usr/sbin/libvirt-qmf	--	gen_context(system_u:object_r:virt_qmf_exec_t,s0)
 /usr/sbin/libvirtd	--	gen_context(system_u:object_r:virtd_exec_t,s0)
+/usr/sbin/virtlockd	--	gen_context(system_u:object_r:virtd_exec_t,s0)
 
 /var/cache/libvirt(/.*)?	gen_context(system_u:object_r:virt_cache_t,s0-mls_systemhigh)
 
diff --git a/virt.te b/virt.te
index f8a59e4..ab8440d 100644
--- a/virt.te
+++ b/virt.te
@@ -524,6 +524,7 @@ stream_connect_pattern(virtd_t, virtd_lxc_var_run_t, virtd_lxc_var_run_t, virtd_
 stream_connect_pattern(virtd_t, svirt_var_run_t, svirt_var_run_t, virt_domain)
 
 can_exec(virtd_t, virt_tmp_t)
+can_exec(virtd_t, virtd_exec_t)
 
 kernel_read_crypto_sysctls(virtd_t)
 kernel_read_system_state(virtd_t)
-- 
2.3.6