From: nicolas.iooss@m4x.org (Nicolas Iooss)
Date: Sun, 3 Sep 2017 23:18:16 +0200
Subject: [refpolicy] [PATCH 1/3] Add policy for systemd GPT generator
In-Reply-To: <20170518193110.27516-2-krzysztof.a.nowicki@gmail.com>
References: <20170514152403.369-1-krzysztof.a.nowicki@gmail.com>
	<20170518193110.27516-1-krzysztof.a.nowicki@gmail.com>
	<20170518193110.27516-2-krzysztof.a.nowicki@gmail.com>
Message-ID: <CAJfZ7=n2B07ekQQz4O0YreRy52eEieaVodvcqiW37Hn9puajyg@mail.gmail.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Thu, May 18, 2017 at 9:31 PM, Krzysztof Nowicki via refpolicy
<refpolicy@oss.tresys.com> wrote:
> From: Krzysztof Nowicki <krissn@op.pl>
>
> ---
>  policy/modules/system/systemd.fc |  3 +++
>  policy/modules/system/systemd.te | 16 ++++++++++++++++
>  2 files changed, 19 insertions(+)
>
> diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
> index b32c006..57944e1 100644
> --- a/policy/modules/system/systemd.fc
> +++ b/policy/modules/system/systemd.fc
> @@ -11,6 +11,9 @@
>  /usr/bin/systemd-tty-ask-password-agent        --      gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0)
>  /usr/bin/systemd-notify                        --      gen_context(system_u:object_r:systemd_notify_exec_t,s0)
>
> +# Systemd generators
> +/usr/lib/systemd/system-generators/systemd-gpt-auto-generator      --      gen_context(system_u:object_r:systemd_gpt_generator_exec_t,s0)
> +
>  /usr/lib/systemd/systemd-activate      --      gen_context(system_u:object_r:systemd_activate_exec_t,s0)
>  /usr/lib/systemd/systemd-backlight     --      gen_context(system_u:object_r:systemd_backlight_exec_t,s0)
>  /usr/lib/systemd/systemd-binfmt                --      gen_context(system_u:object_r:systemd_binfmt_exec_t,s0)
> diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
> index 0a0b34b..eb70c77 100644
> --- a/policy/modules/system/systemd.te
> +++ b/policy/modules/system/systemd.te
> @@ -48,6 +48,10 @@ init_system_domain(systemd_binfmt_t, systemd_binfmt_exec_t)
>  type systemd_binfmt_unit_t;
>  init_unit_file(systemd_binfmt_unit_t)
>
> +type systemd_gpt_generator_t;
> +type systemd_gpt_generator_exec_t;
> +init_system_domain(systemd_gpt_generator_t, systemd_gpt_generator_exec_t)
> +
>  type systemd_cgroups_t;
>  type systemd_cgroups_exec_t;
>  domain_type(systemd_cgroups_t)
> @@ -194,6 +198,18 @@ files_read_etc_files(systemd_binfmt_t)
>
>  fs_register_binary_executable_type(systemd_binfmt_t)
>
> +#######################################
> +#
> +# GPT auto generator local policy
> +#
> +
> +dev_read_sysfs(systemd_gpt_generator_t)
> +files_read_etc_files(systemd_gpt_generator_t)
> +fs_getattr_xattr_fs(systemd_gpt_generator_t)
> +storage_raw_read_fixed_disk(systemd_gpt_generator_t)
> +
> +systemd_log_parse_environment(systemd_gpt_generator_t)
> +
>  ######################################
>  #
>  # Cgroups local policy
> --
> 2.10.2
>
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy

Hi,

I am testing refpolicy in a Arch Linux virtual machine and this patch
fixes some AVC denials I got:

type=AVC msg=audit(1504472249.237:247): avc:  denied  { open } for
pid=1224 comm="systemd-gpt-aut" path="/dev/vda" dev="devtmpfs"
ino=7439 scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file
permissive=1
type=AVC msg=audit(1504472249.237:247): avc:  denied  { read } for
pid=1224 comm="systemd-gpt-aut" name="vda" dev="devtmpfs" ino=7439
scontext=system_u:system_r:initrc_t
tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file
permissive=1

Is there something preventing it from being merged?

Thanks,
Nicolas