RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/udev.fc

46 lines
2.0 KiB
Plaintext
Raw Normal View History

Reverse /dev/.udev/(/.*)? dir label fix. I realized the policy wasn't complete for handling udev_tbl_t dirs, and updating it wouldn't work because we couldn't make a filetrans on dirs, since all the dirs in /dev would become udev_tbl_t. i.e. this would have been required, but would make problems: dev_filetrans(udev_t, udev_tbl_t, dir);
2011-02-17 14:32:00 +00:00
/dev/\.udev(/.*)? -- gen_context(system_u:object_r:udev_tbl_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/dev/\.udevdb -- gen_context(system_u:object_r:udev_tbl_t,s0)
/dev/udev\.tbl -- gen_context(system_u:object_r:udev_tbl_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/dev\.d/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Create new interface and type for managing /etc/udev/rules.d udev_var_run_t is used for managing files in /etc/udev/rules.d as well as other files, including udev pid files. This patch creates a type specifically for rules.d files, and an interface for managing them. It also gives access to this type to initrc_t so that rules can be properly populated during startup. This also fixes a problem on Gentoo where udev rules are NOT properly populated on startup. Signed-off-by: Chris Richards <gizmo@giz-works.com> Signed-off-by: Chris PeBenito <cpebenito@tresys.com>
2010-04-16 06:27:36 +00:00
/etc/udev/rules.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
/usr/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/udevstart -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/wait_for_sysfs -- gen_context(system_u:object_r:udev_exec_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_debian',`
/usr/lib/udev/create_static_nodes -- gen_context(system_u:object_r:udev_exec_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
')
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/udevstart -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/wait_for_sysfs -- gen_context(system_u:object_r:udev_exec_t,s0)
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_redhat',`
/usr/sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
')
Minor whitespace fix in udev.fc
2012-08-08 13:30:09 +00:00
/usr/lib/systemd/systemd-udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
New location for udevd binary Recent udev installs its main binary in /usr/lib/systemd (called systemd-udevd). Update file contexts to support this. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-07-25 11:41:19 +00:00
Label /usr/share/virtualbox/VBoxCreateUSBNode.sh as udev_helper_exec_t VBoxCreateUSBNode.sh creates character special files in /dev/vboxusb each time a new USB device appears. This script is called by udev. audit.log on a system in permissive mode before this patch contains: type=AVC msg=audit(1396889711.890:175): avc: denied { execute } for pid=26284 comm="systemd-udevd" name="VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file type=AVC msg=audit(1396889711.890:175): avc: denied { execute_no_trans } for pid=26284 comm="systemd-udevd" path="/usr/share/virtualbox/VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file
2014-04-14 21:28:00 +00:00
/usr/share/virtualbox/VBoxCreateUSBNode\.sh -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/udev(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
ifdef(`distro_debian',`
Misc fc changes from Russell Coker.
2017-04-06 20:59:47 +00:00
/run/console-setup(/.*)? gen_context(system_u:object_r:udev_var_run_t,s0)
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/xen-hotplug -d gen_context(system_u:object_r:udev_var_run_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
')