From: pebenito@ieee.org (Chris PeBenito)
Date: Thu, 7 Jun 2018 20:08:10 -0400
Subject: [refpolicy] [PATCH 1/1] policy for systemd-hwdb
In-Reply-To: <20180607191941.31672-1-dsugar@tresys.com>
References: <20180607191941.31672-1-dsugar@tresys.com>
Message-ID: <c3d5aaef-8dc1-6e34-1503-c2200e18d7ad@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 06/07/2018 03:19 PM, Dave Sugar via refpolicy wrote:
> systemd-hwdb rebuilds /etc/udev/hwdb.bin from files in /var/lib/udev/hwdb.d/*
> making a temp file first in /etc/udev/ then moving the tmp file
> over hwdb.bin when complete.  It also relabels based in file_contexts
> This provides private type for /etc/udev/hwdb.bin
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   policy/modules/system/systemd.fc |  3 +++
>   policy/modules/system/systemd.if | 19 +++++++++++++++++++
>   policy/modules/system/systemd.te | 24 ++++++++++++++++++++++++
>   policy/modules/system/udev.te    |  1 +
>   4 files changed, 47 insertions(+)
> 
> diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
> index 64f1683c..47a88e8b 100644
> --- a/policy/modules/system/systemd.fc
> +++ b/policy/modules/system/systemd.fc
> @@ -4,6 +4,7 @@
>   /usr/bin/systemd-cgtop			--	gen_context(system_u:object_r:systemd_cgtop_exec_t,s0)
>   /usr/bin/systemd-coredump		--	gen_context(system_u:object_r:systemd_coredump_exec_t,s0)
>   /usr/bin/systemd-detect-virt		--	gen_context(system_u:object_r:systemd_detect_virt_exec_t,s0)
> +/usr/bin/systemd-hwdb			--	gen_context(system_u:object_r:systemd_hw_exec_t,s0)
>   /usr/bin/systemd-nspawn			--	gen_context(system_u:object_r:systemd_nspawn_exec_t,s0)
>   /usr/bin/systemd-run			--	gen_context(system_u:object_r:systemd_run_exec_t,s0)
>   /usr/bin/systemd-stdio-bridge		--	gen_context(system_u:object_r:systemd_stdio_bridge_exec_t,s0)
> @@ -40,6 +41,8 @@
>   /usr/lib/systemd/system/systemd-binfmt.*	--	gen_context(system_u:object_r:systemd_binfmt_unit_t,s0)
>   /usr/lib/systemd/system/systemd-networkd.*		gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
>   
> +/etc/udev/hwdb.bin				--	gen_context(system_u:object_r:systemd_hwdb_t,s0)
> +
>   /var/lib/systemd/backlight(/.*)?	gen_context(system_u:object_r:systemd_backlight_var_lib_t,s0)
>   /var/lib/systemd/coredump(/.*)?	gen_context(system_u:object_r:systemd_coredump_var_lib_t,s0)
>   /var/lib/systemd/linger(/.*)?	gen_context(system_u:object_r:systemd_logind_var_lib_t,s0)
> diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
> index bc988150..8356b143 100644
> --- a/policy/modules/system/systemd.if
> +++ b/policy/modules/system/systemd.if
> @@ -772,5 +772,24 @@ interface(`systemd_getattr_updated_runtime',`
>   ')
>   
>   
> +#######################################
> +## <summary>
> +##  Allow domain to read udev hwdb file
> +## </summary>
> +## <param name="domain">
> +## <summary>
> +##  domain allowed access
> +## </summary>
> +## </param>
> +#
> +interface(`systemd_read_hwdb',`
> +	gen_require(`
> +		type systemd_hwdb_t;
> +	')
> +
> +	read_files_pattern($1, systemd_hwdb_t, systemd_hwdb_t)
> +')
> +
> +
>   
>   
> diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
> index 15fe6e1b..c324d3bf 100644
> --- a/policy/modules/system/systemd.te
> +++ b/policy/modules/system/systemd.te
> @@ -81,6 +81,13 @@ type systemd_hostnamed_t;
>   type systemd_hostnamed_exec_t;
>   init_daemon_domain(systemd_hostnamed_t, systemd_hostnamed_exec_t)
>   
> +type systemd_hw_t;
> +type systemd_hw_exec_t;
> +init_system_domain(systemd_hw_t, systemd_hw_exec_t)
> +
> +type systemd_hwdb_t;
> +files_type(systemd_hwdb_t);
> +
>   type systemd_journal_t;
>   files_type(systemd_journal_t)
>   logging_log_file(systemd_journal_t)
> @@ -322,6 +329,23 @@ optional_policy(`
>   	networkmanager_dbus_chat(systemd_hostnamed_t)
>   ')
>   
> +#########################################
> +#
> +# hw local policy
> +#
> +
> +allow systemd_hw_t systemd_hwdb_t:file { manage_file_perms relabelfrom relabelto };
> +
> +files_etc_filetrans(systemd_hw_t, systemd_hwdb_t, file)
> +files_search_pids(systemd_hw_t)
> +
> +init_read_state(systemd_hw_t)
> +
> +selinux_get_fs_mount(systemd_hw_t)
> +
> +seutil_read_config(systemd_hw_t)
> +seutil_read_file_contexts(systemd_hw_t)
> +
>   #######################################
>   #
>   # locale local policy
> diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
> index d71d0a7f..949853e4 100644
> --- a/policy/modules/system/udev.te
> +++ b/policy/modules/system/udev.te
> @@ -248,6 +248,7 @@ ifdef(`init_systemd',`
>   	init_get_generic_units_status(udev_t)
>   	init_stream_connect(udev_t)
>   
> +	systemd_read_hwdb(udev_t)
>   	systemd_read_logind_sessions_files(udev_t)
>   	systemd_read_logind_pids(udev_t)

Merged.


-- 
Chris PeBenito