From: pebenito@ieee.org (Chris PeBenito)
Date: Mon, 15 May 2017 18:29:13 -0400
Subject: [refpolicy] [PATCH 1/4] Add policy for systemd GPT generator
In-Reply-To: <20170514152403.369-2-krzysztof.a.nowicki@gmail.com>
References: <20170514152403.369-1-krzysztof.a.nowicki@gmail.com>
	<20170514152403.369-2-krzysztof.a.nowicki@gmail.com>
Message-ID: <585b6f1c-264b-b08f-0eaf-31d0fc1b7266@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 05/14/2017 11:24 AM, Krzysztof Nowicki via refpolicy wrote:
> From: Krzysztof Nowicki <krissn@op.pl>
>
> ---
>  policy/modules/system/systemd.fc |  3 +++
>  policy/modules/system/systemd.te | 16 ++++++++++++++++
>  2 files changed, 19 insertions(+)
>
> diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
> index b32c006..7fa03ad 100644
> --- a/policy/modules/system/systemd.fc
> +++ b/policy/modules/system/systemd.fc
> @@ -23,6 +23,9 @@
>  /usr/lib/systemd/systemd-resolved	--	gen_context(system_u:object_r:systemd_resolved_exec_t,s0)
>  /usr/lib/systemd/systemd-user-sessions	--	gen_context(system_u:object_r:systemd_sessions_exec_t,s0)
>
> +# Systemd generators
> +/usr/lib/systemd/system-generators/systemd-gpt-auto-generator	    --	    gen_context(system_u:object_r:systemd_generator_gpt_exec_t,s0)
> +
>  # Systemd unit files
>  /usr/lib/systemd/system/[^/]*halt.*	--	gen_context(system_u:object_r:power_unit_t,s0)
>  /usr/lib/systemd/system/[^/]*hibernate.* --	gen_context(system_u:object_r:power_unit_t,s0)
> diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
> index 0a0b34b..7782528 100644
> --- a/policy/modules/system/systemd.te
> +++ b/policy/modules/system/systemd.te
> @@ -48,6 +48,10 @@ init_system_domain(systemd_binfmt_t, systemd_binfmt_exec_t)
>  type systemd_binfmt_unit_t;
>  init_unit_file(systemd_binfmt_unit_t)
>
> +type systemd_generator_gpt_t;
> +type systemd_generator_gpt_exec_t;
> +init_system_domain(systemd_generator_gpt_t, systemd_generator_gpt_exec_t)

I think a type name like systemd_gpt_generator_t would make more sense.


>  type systemd_cgroups_t;
>  type systemd_cgroups_exec_t;
>  domain_type(systemd_cgroups_t)
> @@ -194,6 +198,18 @@ files_read_etc_files(systemd_binfmt_t)
>
>  fs_register_binary_executable_type(systemd_binfmt_t)
>
> +#######################################
> +#
> +# GPT auto generator local policy
> +#
> +
> +systemd_log_parse_environment(systemd_generator_gpt_t)
> +
> +storage_raw_read_fixed_disk(systemd_generator_gpt_t)
> +dev_read_sysfs(systemd_generator_gpt_t)
> +files_read_etc_files(systemd_generator_gpt_t)
> +fs_getattr_xattr_fs(systemd_generator_gpt_t)

Please reorder for style.

-- 
Chris PeBenito