From: pebenito@ieee.org (Chris PeBenito)
Date: Mon, 9 Oct 2017 14:50:07 -0400
Subject: [refpolicy] [refpolicy SELinux PATCH 2/2] kernel/xen: Add map
 permission to the dev_rw_xen
In-Reply-To: <20171009155347.8871-3-konrad@darnok.org>
References: <20171009155347.8871-1-konrad@darnok.org>
	<20171009155347.8871-3-konrad@darnok.org>
Message-ID: <311752d1-aebf-2d8f-3e94-4dc9dc83537b@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 10/09/2017 11:53 AM, Konrad Rzeszutek Wilk via refpolicy wrote:
> From: Konrad Rzeszutek Wilk <konrad@kernel.org>
> 
> type=AVC msg=audit(1504637347.487:280): avc:  denied  { map } for  pid=857 comm="xenconsoled" path="/dev/xen/privcmd" dev="devtmpfs" ino=16289 scontext=system_u:system_r:xenconsoled_t:s0
> 
> Without this we can't use xenconsole (client) to
> talk to xenconsoled (server).
> 
> Signed-off-by: Konrad Rzeszutek Wilk <konrad@kernel.org>
> ---
>   policy/modules/kernel/devices.if | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
> index 4c47709ff..c9071df8f 100644
> --- a/policy/modules/kernel/devices.if
> +++ b/policy/modules/kernel/devices.if
> @@ -4984,6 +4984,7 @@ interface(`dev_rw_xen',`
>   	')
>   
>   	rw_chr_files_pattern($1, device_t, xen_device_t)
> +	allow $1 xen_device_t:chr_file map;
>   ')
>   
>   ########################################

Merged.

-- 
Chris PeBenito