From: pebenito@ieee.org (Chris PeBenito)
Date: Sun, 15 Jul 2018 16:57:15 -0400
Subject: [refpolicy] [PATCH] vhost: Add /dev/vhost-scsi device of type
 vhost_device_t.
In-Reply-To: <1531501536-15106-1-git-send-email-jag.raman@oracle.com>
References: <1531501536-15106-1-git-send-email-jag.raman@oracle.com>
Message-ID: <c07ccfa9-f4b3-cf0b-8665-38258074ad51@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 07/13/2018 01:05 PM, Jagannathan Raman wrote:
> Signed-off-by: Jagannathan Raman <jag.raman@oracle.com>
> ---
>   policy/modules/kernel/devices.fc | 1 +
>   policy/modules/kernel/devices.if | 2 +-
>   policy/modules/kernel/devices.te | 3 ++-
>   3 files changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
> index e206720..5ec14ac 100644
> --- a/policy/modules/kernel/devices.fc
> +++ b/policy/modules/kernel/devices.fc
> @@ -120,6 +120,7 @@ ifdef(`distro_suse', `
>   ')
>   /dev/vfio/.+		-c      gen_context(system_u:object_r:vfio_device_t,s0)
>   /dev/vhost-net		-c	gen_context(system_u:object_r:vhost_device_t,s0)
> +/dev/vhost-scsi		-c	gen_context(system_u:object_r:vhost_device_t,s0)
>   /dev/vbi.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
>   /dev/vbox.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
>   /dev/vga_arbiter	-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)
> diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
> index 6bbea59..65bfcb6 100644
> --- a/policy/modules/kernel/devices.if
> +++ b/policy/modules/kernel/devices.if
> @@ -4839,7 +4839,7 @@ interface(`dev_relabelfrom_vfio_dev',`
>   
>   ############################
>   ## <summary>
> -##	Allow read/write the vhost net device
> +##	Allow read/write the vhost devices
>   ## </summary>
>   ## <param name="domain">
>   ##	<summary>
> diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
> index 4ce5fec..79b9c8d 100644
> --- a/policy/modules/kernel/devices.te
> +++ b/policy/modules/kernel/devices.te
> @@ -286,7 +286,8 @@ type v4l_device_t;
>   dev_node(v4l_device_t)
>   
>   #
> -# vhost_device_t is the type for /dev/vhost-net
> +# vhost_device_t is the type for vhost devices like
> +# /dev/vhost-net and /dev/vhost-scsi
>   #
>   type vhost_device_t;
>   dev_node(vhost_device_t)

Merged.

-- 
Chris PeBenito