From: krzysztof.a.nowicki@gmail.com (krzysztof.a.nowicki at gmail.com) Date: Sun, 14 May 2017 17:24:00 +0200 Subject: [refpolicy] [PATCH 1/4] Add policy for systemd GPT generator In-Reply-To: <20170514152403.369-1-krzysztof.a.nowicki@gmail.com> References: <20170514152403.369-1-krzysztof.a.nowicki@gmail.com> Message-ID: <20170514152403.369-2-krzysztof.a.nowicki@gmail.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com From: Krzysztof Nowicki --- policy/modules/system/systemd.fc | 3 +++ policy/modules/system/systemd.te | 16 ++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc index b32c006..7fa03ad 100644 --- a/policy/modules/system/systemd.fc +++ b/policy/modules/system/systemd.fc @@ -23,6 +23,9 @@ /usr/lib/systemd/systemd-resolved -- gen_context(system_u:object_r:systemd_resolved_exec_t,s0) /usr/lib/systemd/systemd-user-sessions -- gen_context(system_u:object_r:systemd_sessions_exec_t,s0) +# Systemd generators +/usr/lib/systemd/system-generators/systemd-gpt-auto-generator -- gen_context(system_u:object_r:systemd_generator_gpt_exec_t,s0) + # Systemd unit files /usr/lib/systemd/system/[^/]*halt.* -- gen_context(system_u:object_r:power_unit_t,s0) /usr/lib/systemd/system/[^/]*hibernate.* -- gen_context(system_u:object_r:power_unit_t,s0) diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 0a0b34b..7782528 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -48,6 +48,10 @@ init_system_domain(systemd_binfmt_t, systemd_binfmt_exec_t) type systemd_binfmt_unit_t; init_unit_file(systemd_binfmt_unit_t) +type systemd_generator_gpt_t; +type systemd_generator_gpt_exec_t; +init_system_domain(systemd_generator_gpt_t, systemd_generator_gpt_exec_t) + type systemd_cgroups_t; type systemd_cgroups_exec_t; domain_type(systemd_cgroups_t) @@ -194,6 +198,18 @@ files_read_etc_files(systemd_binfmt_t) fs_register_binary_executable_type(systemd_binfmt_t) +####################################### +# +# GPT auto generator local policy +# + +systemd_log_parse_environment(systemd_generator_gpt_t) + +storage_raw_read_fixed_disk(systemd_generator_gpt_t) +dev_read_sysfs(systemd_generator_gpt_t) +files_read_etc_files(systemd_generator_gpt_t) +fs_getattr_xattr_fs(systemd_generator_gpt_t) + ###################################### # # Cgroups local policy -- 2.10.2