From: konrad@kernel.org (Konrad Rzeszutek Wilk) Date: Mon, 9 Oct 2017 11:53:47 -0400 Subject: [refpolicy] [refpolicy SELinux PATCH 2/2] kernel/xen: Add map permission to the dev_rw_xen In-Reply-To: <20171009155347.8871-1-konrad@darnok.org> References: <20171009155347.8871-1-konrad@darnok.org> Message-ID: <20171009155347.8871-3-konrad@darnok.org> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com From: Konrad Rzeszutek Wilk type=AVC msg=audit(1504637347.487:280): avc: denied { map } for pid=857 comm="xenconsoled" path="/dev/xen/privcmd" dev="devtmpfs" ino=16289 scontext=system_u:system_r:xenconsoled_t:s0 Without this we can't use xenconsole (client) to talk to xenconsoled (server). Signed-off-by: Konrad Rzeszutek Wilk --- policy/modules/kernel/devices.if | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index 4c47709ff..c9071df8f 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -4984,6 +4984,7 @@ interface(`dev_rw_xen',` ') rw_chr_files_pattern($1, device_t, xen_device_t) + allow $1 xen_device_t:chr_file map; ') ######################################## -- 2.13.3