From: pebenito@ieee.org (Chris PeBenito)
Date: Wed, 24 May 2017 19:53:58 -0400
Subject: [refpolicy] [PATCH v2] contrib: allow map permission where
	needed
In-Reply-To: <20170524194122.12319-1-sds@tycho.nsa.gov>
References: <20170524194122.12319-1-sds@tycho.nsa.gov>
Message-ID: <7d84936a-5bb8-f035-52d8-16c925bc4bac@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 05/24/2017 03:41 PM, Stephen Smalley via refpolicy wrote:
> Allow map permission where needed, based on limited testing.
> Introduced in the kernel in commit 6941857e82ae ("selinux: add a map
> permission check for mmap").  Depends on "refpolicy: Define and
> allow map permission" to define the permission.
>
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
>  abrt.te           | 2 ++
>  gnome.if          | 2 +-
>  networkmanager.if | 3 +++
>  rpm.if            | 3 +++
>  4 files changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/abrt.te b/abrt.te
> index 9fb4f3f..6098ee5 100644
> --- a/abrt.te
> +++ b/abrt.te
> @@ -397,6 +397,8 @@ domain_use_interactive_fds(abrt_dump_oops_t)
>  fs_list_inotifyfs(abrt_dump_oops_t)
>
>  logging_read_generic_logs(abrt_dump_oops_t)
> +logging_mmap_generic_logs(abrt_dump_oops_t)
> +logging_mmap_journal(abrt_dump_oops_t)
>
>  #######################################
>  #
> diff --git a/gnome.if b/gnome.if
> index 4fcc690..edf4d4e 100644
> --- a/gnome.if
> +++ b/gnome.if
> @@ -332,7 +332,7 @@ interface(`gnome_read_generic_home_content',`
>
>  	userdom_search_user_home_dirs($1)
>  	allow $1 gnome_home_t:dir list_dir_perms;
> -	allow $1 gnome_home_t:file read_file_perms;
> +	allow $1 gnome_home_t:file { read_file_perms map };
>  	allow $1 gnome_home_t:fifo_file read_fifo_file_perms;
>  	allow $1 gnome_home_t:lnk_file read_lnk_file_perms;
>  	allow $1 gnome_home_t:sock_file read_sock_file_perms;
> diff --git a/networkmanager.if b/networkmanager.if
> index fdc10ef..20bdcbc 100644
> --- a/networkmanager.if
> +++ b/networkmanager.if
> @@ -209,6 +209,7 @@ interface(`networkmanager_manage_lib_files',`
>
>  	files_search_var_lib($1)
>  	manage_files_pattern($1, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
> +	allow $1 NetworkManager_var_lib_t:file map;
>  ')
>
>  ########################################
> @@ -229,6 +230,7 @@ interface(`networkmanager_read_lib_files',`
>  	files_search_var_lib($1)
>  	list_dirs_pattern($1, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
>  	read_files_pattern($1, NetworkManager_var_lib_t, NetworkManager_var_lib_t)
> +	allow $1 NetworkManager_var_lib_t:file map;
>  ')
>
>  ########################################
> @@ -328,6 +330,7 @@ interface(`networkmanager_admin',`
>
>  	files_search_var_lib($1)
>  	admin_pattern($1, NetworkManager_var_lib_t)
> +	allow $1 NetworkManager_var_lib_t:file map;
>
>  	files_search_pids($1)
>  	admin_pattern($1, NetworkManager_var_run_t)
> diff --git a/rpm.if b/rpm.if
> index 2344edd..304e97c 100644
> --- a/rpm.if
> +++ b/rpm.if
> @@ -459,6 +459,7 @@ interface(`rpm_read_db',`
>  	allow $1 rpm_var_lib_t:dir list_dir_perms;
>  	read_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
>  	read_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
> +	allow $1 rpm_var_lib_t:file map;
>  ')
>
>  ########################################
> @@ -499,6 +500,7 @@ interface(`rpm_manage_db',`
>  	files_search_var_lib($1)
>  	manage_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
>  	manage_lnk_files_pattern($1, rpm_var_lib_t, rpm_var_lib_t)
> +	allow $1 rpm_var_lib_t:file map;
>  ')
>
>  ########################################
> @@ -520,6 +522,7 @@ interface(`rpm_dontaudit_manage_db',`
>  	dontaudit $1 rpm_var_lib_t:dir rw_dir_perms;
>  	dontaudit $1 rpm_var_lib_t:file manage_file_perms;
>  	dontaudit $1 rpm_var_lib_t:lnk_file manage_lnk_file_perms;
> +	dontaudit $1 rpm_var_lib_t:file map;
>  ')
>
>  #####################################


Merged.

-- 
Chris PeBenito