2017-10-09 15:53:47

by Konrad Rzeszutek Wilk

Subject: [refpolicy] [refpolicy SELinux PATCH 2/2] kernel/xen: Add map permission to the dev_rw_xen

From: Konrad Rzeszutek Wilk <[email protected]>

type=AVC msg=audit(1504637347.487:280): avc: denied { map } for pid=857 comm="xenconsoled" path="/dev/xen/privcmd" dev="devtmpfs" ino=16289 scontext=system_u:system_r:xenconsoled_t:s0

Without this we can't use xenconsole (client) to
talk to xenconsoled (server).

Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
---
policy/modules/kernel/devices.if | 1 +
1 file changed, 1 insertion(+)

diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 4c47709ff..c9071df8f 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -4984,6 +4984,7 @@ interface(`dev_rw_xen',`
')

rw_chr_files_pattern($1, device_t, xen_device_t)
+ allow $1 xen_device_t:chr_file map;
')

########################################
--
2.13.3

2017-10-09 18:50:07

by Chris PeBenito

Subject: [refpolicy] [refpolicy SELinux PATCH 2/2] kernel/xen: Add map permission to the dev_rw_xen

On 10/09/2017 11:53 AM, Konrad Rzeszutek Wilk via refpolicy wrote:
> From: Konrad Rzeszutek Wilk <[email protected]>
>
> type=AVC msg=audit(1504637347.487:280): avc: denied { map } for pid=857 comm="xenconsoled" path="/dev/xen/privcmd" dev="devtmpfs" ino=16289 scontext=system_u:system_r:xenconsoled_t:s0
>
> Without this we can't use xenconsole (client) to
> talk to xenconsoled (server).
>
> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
> ---
> policy/modules/kernel/devices.if | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
> index 4c47709ff..c9071df8f 100644
> --- a/policy/modules/kernel/devices.if
> +++ b/policy/modules/kernel/devices.if
> @@ -4984,6 +4984,7 @@ interface(`dev_rw_xen',`
> ')
>
> rw_chr_files_pattern($1, device_t, xen_device_t)
> + allow $1 xen_device_t:chr_file map;
> ')
>
> ########################################

Merged.

--
Chris PeBenito