RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/udev.fc

43 lines
1.9 KiB
Plaintext
Raw Normal View History

rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/dev\.d/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Remove unescaped single dot from the policy In a pattern, a dot can match any character, including slash. It makes sense when it is combined with ?, + or *, but makes little sense when left alone. Most of the time, the label was for file containing dots, where the dot was not escaped. A few times, the dot was really intended to match any character. In such case, [^/] better suits the intent. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-08-27 21:38:09 +00:00
/etc/udev/rules\.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
udev: Systemd 246 merged udev and udevadm executables. Drop init_system_domain() for udevadm to break type transition conflicts. Also fix interface naming issues for udevadm interfaces. Fixes #292 Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2021-01-08 21:50:01 +00:00
/usr/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/udevstart -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/wait_for_sysfs -- gen_context(system_u:object_r:udev_exec_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_debian',`
/usr/lib/udev/create_static_nodes -- gen_context(system_u:object_r:udev_exec_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
')
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
udev: Systemd 246 merged udev and udevadm executables. Drop init_system_domain() for udevadm to break type transition conflicts. Also fix interface naming issues for udevadm interfaces. Fixes #292 Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2021-01-08 21:50:01 +00:00
/usr/sbin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/udevstart -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/wait_for_sysfs -- gen_context(system_u:object_r:udev_exec_t,s0)
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_redhat',`
/usr/sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
')
Minor whitespace fix in udev.fc
2012-08-08 13:30:09 +00:00
/usr/lib/systemd/systemd-udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
udev: allow udev_t to watch udev_rules_t dir Fixes: avc: denied { watch } for pid=187 comm="udevd" path="/lib/udev/rules.d" dev="vda" ino=1060 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:lib_t tclass=dir permissive=0 avc: denied { watch } for pid=187 comm="udevd" path="/etc/udev/rules.d" dev="vda" ino=886 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:udev_rules_t tclass=dir permissive=0 avc: denied { watch } for pid=187 comm="udevd" path="/run/udev/rules.d" dev="tmpfs" ino=4 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:udev_runtime_t tclass=dir permissive=0 avc: denied { watch } for pid=196 comm="udevadm" path="/run/udev" dev="tmpfs" ino=2 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:udev_runtime_t tclass=dir permissive=0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2021-10-10 15:21:09 +00:00
/usr/lib/udev/rules\.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0)
New location for udevd binary Recent udev installs its main binary in /usr/lib/systemd (called systemd-udevd). Update file contexts to support this. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-07-25 11:41:19 +00:00
Label /usr/share/virtualbox/VBoxCreateUSBNode.sh as udev_helper_exec_t VBoxCreateUSBNode.sh creates character special files in /dev/vboxusb each time a new USB device appears. This script is called by udev. audit.log on a system in permissive mode before this patch contains: type=AVC msg=audit(1396889711.890:175): avc: denied { execute } for pid=26284 comm="systemd-udevd" name="VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file type=AVC msg=audit(1396889711.890:175): avc: denied { execute_no_trans } for pid=26284 comm="systemd-udevd" path="/usr/share/virtualbox/VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file
2014-04-14 21:28:00 +00:00
/usr/share/virtualbox/VBoxCreateUSBNode\.sh -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/udev(/.*)? gen_context(system_u:object_r:udev_runtime_t,s0)
udev: allow udev_t to watch udev_rules_t dir Fixes: avc: denied { watch } for pid=187 comm="udevd" path="/lib/udev/rules.d" dev="vda" ino=1060 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:lib_t tclass=dir permissive=0 avc: denied { watch } for pid=187 comm="udevd" path="/etc/udev/rules.d" dev="vda" ino=886 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:udev_rules_t tclass=dir permissive=0 avc: denied { watch } for pid=187 comm="udevd" path="/run/udev/rules.d" dev="tmpfs" ino=4 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:udev_runtime_t tclass=dir permissive=0 avc: denied { watch } for pid=196 comm="udevadm" path="/run/udev" dev="tmpfs" ino=2 scontext=system_u:system_r:udev_t tcontext=system_u:object_r:udev_runtime_t tclass=dir permissive=0 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
2021-10-10 15:21:09 +00:00
/run/udev/rules\.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
ifdef(`distro_debian',`
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/xen-hotplug -d gen_context(system_u:object_r:udev_runtime_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
')