From: cgzones@googlemail.com (=?UTF-8?q?Christian=20G=C3=B6ttsche?=)
Date: Thu, 14 Sep 2017 13:47:48 +0200
Subject: [refpolicy] [PATCH] dphysswapfile: fix swapfile creation
Message-ID: <20170914114748.4169-1-cgzones@googlemail.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

Currently the policy only works when the swapfile already exists.
During creation swapfile_t is hard coded in `mkswap` and needs to be used.

v2:
move swapfile file context into fstools module
---
 dphysswapfile.fc |  6 +++---
 dphysswapfile.if |  6 ++++--
 dphysswapfile.te | 14 +++++++++++++-
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/dphysswapfile.fc b/dphysswapfile.fc
index 70b0ee3..dd8ab60 100644
--- a/dphysswapfile.fc
+++ b/dphysswapfile.fc
@@ -2,8 +2,8 @@
 
 /etc/rc\.d/init\.d/dphys-swapfile	--	gen_context(system_u:object_r:dphysswapfile_initrc_exec_t,s0)
 
-/usr/bin/dphys-swapfile		--	gen_context(system_u:object_r:dphysswapfile_exec_t,s0)
+/usr/bin/dphys-swapfile			--	gen_context(system_u:object_r:dphysswapfile_exec_t,s0)
 
-/usr/sbin/dphys-swapfile		--	gen_context(system_u:object_r:dphysswapfile_exec_t,s0)
+/usr/lib/systemd/system/dphys-swapfile\.service -- gen_context(system_u:object_r:dphysswapfile_unit_t,s0)
 
-/var/swap				--	gen_context(system_u:object_r:dphysswapfile_swap_t,s0)
+/usr/sbin/dphys-swapfile		--	gen_context(system_u:object_r:dphysswapfile_exec_t,s0)
diff --git a/dphysswapfile.if b/dphysswapfile.if
index 7dda955..c39464e 100644
--- a/dphysswapfile.if
+++ b/dphysswapfile.if
@@ -11,6 +11,8 @@
 ## </param>
 #
 interface(`dphysswapfile_dontaudit_read_swap',`
+	refpolicywarn(`$0($*) has been deprecated')
+
 	gen_require(`
 		type dphysswapfile_swap_t;
 	')
@@ -38,12 +40,12 @@ interface(`dphysswapfile_dontaudit_read_swap',`
 interface(`dphysswapfile_admin',`
 	gen_require(`
 		type dphysswapfile_t, dphysswapfile_conf_t;
-		type dphysswapfile_initrc_exec_t;
+		type dphysswapfile_initrc_exec_t, dphysswapfile_unit_t;
 	')
 
 	admin_process_pattern($1, dphysswapfile_t)
 
-	init_startstop_service($1, $2, dphysswapfile_t, dphysswapfile_initrc_exec_t)
+	init_startstop_service($1, $2, dphysswapfile_t, dphysswapfile_initrc_exec_t, dphysswapfile_unit_t)
 
 	files_search_etc($1)
 	admin_pattern($1, dphysswapfile_conf_t)
diff --git a/dphysswapfile.te b/dphysswapfile.te
index dfd04e3..4bfe782 100644
--- a/dphysswapfile.te
+++ b/dphysswapfile.te
@@ -18,6 +18,9 @@ init_script_file(dphysswapfile_initrc_exec_t)
 type dphysswapfile_swap_t;
 files_type(dphysswapfile_swap_t)
 
+type dphysswapfile_unit_t;
+init_unit_file(dphysswapfile_unit_t)
+
 ########################################
 #
 # Policy
@@ -32,20 +35,29 @@ allow dphysswapfile_t dphysswapfile_conf_t:file read_file_perms;
 
 allow dphysswapfile_t dphysswapfile_exec_t:file execute_no_trans;
 
-allow dphysswapfile_t dphysswapfile_swap_t:file manage_file_perms;
+allow dphysswapfile_t dphysswapfile_swap_t:file { manage_file_perms relabelfrom };
 
 kernel_read_system_state(dphysswapfile_t)
 
 corecmd_exec_bin(dphysswapfile_t)
 corecmd_exec_shell(dphysswapfile_t)
 
+dev_read_rand(dphysswapfile_t)
+dev_read_urand(dphysswapfile_t)
+
 # ignore ls -l /var/swap noise
 files_dontaudit_getattr_pid_dirs(dphysswapfile_t)
 files_read_etc_files(dphysswapfile_t)
 files_search_var(dphysswapfile_t)
+files_var_filetrans(dphysswapfile_t, dphysswapfile_swap_t, file)
 
 fstools_exec(dphysswapfile_t)
+# swapfile_t is hardcoded in mkswap
+fstools_manage_swap_files(dphysswapfile_t)
+fstools_relabelto_swap_files(dphysswapfile_t)
 
 miscfiles_read_localization(dphysswapfile_t)
 
+storage_getattr_removable_dev(dphysswapfile_t)
+
 userdom_dontaudit_search_user_home_dirs(dphysswapfile_t)
-- 
2.14.1