From: pebenito@ieee.org (Chris PeBenito) Date: Wed, 6 Sep 2017 10:06:59 -0400 Subject: [refpolicy] [PATCH 1/3] Add policy for systemd GPT generator In-Reply-To: References: <20170514152403.369-1-krzysztof.a.nowicki@gmail.com> <20170518193110.27516-1-krzysztof.a.nowicki@gmail.com> <20170518193110.27516-2-krzysztof.a.nowicki@gmail.com> Message-ID: <222660e1-1b5e-3427-d5c5-ab839aaa632c@ieee.org> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com On 09/03/2017 05:18 PM, Nicolas Iooss via refpolicy wrote: > On Thu, May 18, 2017 at 9:31 PM, Krzysztof Nowicki via refpolicy > wrote: >> From: Krzysztof Nowicki >> >> --- >> policy/modules/system/systemd.fc | 3 +++ >> policy/modules/system/systemd.te | 16 ++++++++++++++++ >> 2 files changed, 19 insertions(+) >> >> diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc >> index b32c006..57944e1 100644 >> --- a/policy/modules/system/systemd.fc >> +++ b/policy/modules/system/systemd.fc >> @@ -11,6 +11,9 @@ >> /usr/bin/systemd-tty-ask-password-agent -- gen_context(system_u:object_r:systemd_passwd_agent_exec_t,s0) >> /usr/bin/systemd-notify -- gen_context(system_u:object_r:systemd_notify_exec_t,s0) >> >> +# Systemd generators >> +/usr/lib/systemd/system-generators/systemd-gpt-auto-generator -- gen_context(system_u:object_r:systemd_gpt_generator_exec_t,s0) >> + >> /usr/lib/systemd/systemd-activate -- gen_context(system_u:object_r:systemd_activate_exec_t,s0) >> /usr/lib/systemd/systemd-backlight -- gen_context(system_u:object_r:systemd_backlight_exec_t,s0) >> /usr/lib/systemd/systemd-binfmt -- gen_context(system_u:object_r:systemd_binfmt_exec_t,s0) >> diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te >> index 0a0b34b..eb70c77 100644 >> --- a/policy/modules/system/systemd.te >> +++ b/policy/modules/system/systemd.te >> @@ -48,6 +48,10 @@ init_system_domain(systemd_binfmt_t, systemd_binfmt_exec_t) >> type systemd_binfmt_unit_t; >> init_unit_file(systemd_binfmt_unit_t) >> >> +type systemd_gpt_generator_t; >> +type systemd_gpt_generator_exec_t; >> +init_system_domain(systemd_gpt_generator_t, systemd_gpt_generator_exec_t) >> + >> type systemd_cgroups_t; >> type systemd_cgroups_exec_t; >> domain_type(systemd_cgroups_t) >> @@ -194,6 +198,18 @@ files_read_etc_files(systemd_binfmt_t) >> >> fs_register_binary_executable_type(systemd_binfmt_t) >> >> +####################################### >> +# >> +# GPT auto generator local policy >> +# >> + >> +dev_read_sysfs(systemd_gpt_generator_t) >> +files_read_etc_files(systemd_gpt_generator_t) >> +fs_getattr_xattr_fs(systemd_gpt_generator_t) >> +storage_raw_read_fixed_disk(systemd_gpt_generator_t) >> + >> +systemd_log_parse_environment(systemd_gpt_generator_t) >> + >> ###################################### >> # >> # Cgroups local policy >> -- >> 2.10.2 >> >> _______________________________________________ >> refpolicy mailing list >> refpolicy at oss.tresys.com >> http://oss.tresys.com/mailman/listinfo/refpolicy > > Hi, > > I am testing refpolicy in a Arch Linux virtual machine and this patch > fixes some AVC denials I got: > > type=AVC msg=audit(1504472249.237:247): avc: denied { open } for > pid=1224 comm="systemd-gpt-aut" path="/dev/vda" dev="devtmpfs" > ino=7439 scontext=system_u:system_r:initrc_t > tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file > permissive=1 > type=AVC msg=audit(1504472249.237:247): avc: denied { read } for > pid=1224 comm="systemd-gpt-aut" name="vda" dev="devtmpfs" ino=7439 > scontext=system_u:system_r:initrc_t > tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file > permissive=1 > > Is there something preventing it from being merged? No. -- Chris PeBenito