RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/modutils.te

194 lines
4.2 KiB
Plaintext
Raw Normal View History

Bump module versions for release. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-08-18 13:09:10 +00:00
policy_module(modutils, 1.23.0)
fix several modular build problems
2005-11-29 21:27:15 +00:00
make a reasonable lib_t interface
2005-05-11 15:46:51 +00:00
########################################
#
# Declarations
#
modutils: adjust interfaces after recent binaries merge
2017-02-18 21:09:24 +00:00
attribute_role kmod_roles;
Remove old aliases. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-11 00:52:54 +00:00
type kmod_t;
type kmod_exec_t;
modutils: allow init to execute kmod with nnp Signed-off-by: bauen1 <j2468h@gmail.com>
2020-02-12 16:28:43 +00:00
init_system_domain(kmod_t, kmod_exec_t)
modutils: Move lines.
2016-12-07 01:01:22 +00:00
kernel_domtrans_to(kmod_t, kmod_exec_t)
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
mls_file_write_all_levels(kmod_t)
modutils: adjust interfaces after recent binaries merge
2017-02-18 21:09:24 +00:00
role kmod_roles types kmod_t;
initial commit
2005-04-14 20:18:17 +00:00
fix ordering in modutils.
2009-08-05 14:11:08 +00:00
# module loading config
type modules_conf_t;
files_type(modules_conf_t)
# module dependencies
type modules_dep_t;
files_type(modules_dep_t)
more insmod work, bring in depmod and update_modules
2005-04-20 21:00:01 +00:00
systemd-tmpfiles: refactor runtime configs handle runtime configuration files under /run/tmpfiles.d as 3rd party content, like /run or /var/lib
2017-02-18 21:16:30 +00:00
ifdef(`init_systemd',`
type kmod_tmpfiles_conf_t;
systemd_tmpfiles_conf_file(kmod_tmpfiles_conf_t)
systemd_tmpfiles_conf_filetrans(kmod_t, kmod_tmpfiles_conf_t, file)
')
fix ordering in modutils.
2009-08-05 14:11:08 +00:00
more insmod work, bring in depmod and update_modules
2005-04-20 21:00:01 +00:00
########################################
#
# insmod local policy
#
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
allow kmod_t self:capability { dac_override net_raw sys_nice sys_tty_config };
allow kmod_t self:process { execmem sigchld sigkill sigstop signull signal };
modutils: Dontaudit CAP_SYS_ADMIN checks for modprobe The ttm module, a dependency of radeon/amdgpu, does some capable(CAP_SYS_ADMIN) checks. Changes in 4.13 have caused some of these checks to be executed during module initialization, in the context of modprobe, which fills the audit logs with a lot of denials. Since failing these capable() checks is not an issue (they merely control the access to emergency memory reserves, which shouldn't be an issue during boot), I'm dontauditing them. One potential issue with this is that if a module that actually needs CAP_SYS_ADMIN during initialization comes along later, the dontaudit is going to make the debugging a bit more annoying. Is anyone concerned about this?
2017-11-15 07:09:50 +00:00
# for the radeon/amdgpu modules
dontaudit kmod_t self:capability sys_admin;
more insmod work, bring in depmod and update_modules
2005-04-20 21:00:01 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
allow kmod_t self:udp_socket create_socket_perms;
allow kmod_t self:rawip_socket create_socket_perms;
more insmod work, bring in depmod and update_modules
2005-04-20 21:00:01 +00:00
reorder for more consistency
2005-05-11 15:22:28 +00:00
# Read module config and dependency information
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
list_dirs_pattern(kmod_t, modules_conf_t, modules_conf_t)
read_files_pattern(kmod_t, modules_conf_t, modules_conf_t)
Looks like this got dropped in pull request #294 Seeing the following denial - adding back in: localhost kernel: type=1400 audit(1598497795.109:57): avc: denied { map } for pid=1054 comm="modprobe" path="/usr/lib/modules/3.10.0-1127.19.1.el7.x86_64/modules.dep.bin" dev="dm-0" ino=23711 scontext=system_u:system_r:kmod_t:s0 tcontext=system_u:object_r:modules_dep_t:s0 tclass=file permissive=0 Signed-off-by: Dave Sugar <dsugar100@gmail.com>
2020-08-27 03:12:34 +00:00
allow kmod_t modules_dep_t:file map;
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
list_dirs_pattern(kmod_t, modules_dep_t, modules_dep_t)
manage_files_pattern(kmod_t, modules_dep_t, modules_dep_t)
files/modutils: unify modules_object_t usage into files module modutils.te: 50: (W): No explicit declaration for modules_object_t from module files. You should access it via interface call or use a require block. (W-001) modutils.te: 51: (W): No explicit declaration for modules_object_t from module files. You should access it via interface call or use a require block. (W-001) modutils.te: 52: (W): No explicit declaration for modules_object_t from module files. You should access it via interface call or use a require block. (W-001) modutils.te: 53: (W): No explicit declaration for modules_object_t from module files. You should access it via interface call or use a require block. (W-001) modutils.if: 15: (W): Definition of declared type modules_object_t not found in own module, but in module files (W-011) modutils.if: 52: (W): Definition of declared type modules_object_t not found in own module, but in module files (W-011) modutils.fc: 24: (S): Type modules_object_t is declared in module files, but used in file context here. (S-002) Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-08-12 16:17:19 +00:00
files_kernel_modules_filetrans(kmod_t, modules_dep_t, file)
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
can_exec(kmod_t, kmod_exec_t)
kernel_load_module(kmod_t)
kernel_request_load_module(kmod_t)
Allow kmod to read /proc/sys/crypto/fips_enabled type=AVC msg=audit(1543769402.716:165): avc: denied { search } for pid=6716 comm="sysctl" name="crypto" dev="proc" ino=10284 scontext=system_u:system_r:kmod_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1543769402.716:165): avc: denied { read } for pid=6716 comm="sysctl" name="fips_enabled" dev="proc" ino=10285 scontext=system_u:system_r:kmod_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1 type=AVC msg=audit(1543769402.716:165): avc: denied { open } for pid=6716 comm="sysctl" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=10285 scontext=system_u:system_r:kmod_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1 type=AVC msg=audit(1543769402.717:166): avc: denied { getattr } for pid=6716 comm="sysctl" path="/proc/sys/crypto/fips_enabled" dev="proc" ino=10285 scontext=system_u:system_r:kmod_t:s0 tcontext=system_u:object_r:sysctl_crypto_t:s0 tclass=file permissive=1 Signed-off-by: Dave Sugar <dsugar@tresys.com>
2018-12-08 18:45:34 +00:00
kernel_read_crypto_sysctls(kmod_t)
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
kernel_read_system_state(kmod_t)
kernel_read_network_state(kmod_t)
kernel_write_proc_files(kmod_t)
kernel_mount_debugfs(kmod_t)
kernel_mount_kvmfs(kmod_t)
kernel_read_debugfs(kmod_t)
modutils: Move lines.
2016-12-07 01:01:22 +00:00
kernel_search_key(kmod_t)
initial commit
2005-04-14 20:18:17 +00:00
# Rules for /proc/sys/kernel/tainted
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
kernel_read_kernel_sysctls(kmod_t)
kernel_rw_kernel_sysctl(kmod_t)
kernel_read_hotplug_sysctls(kmod_t)
kernel_setsched(kmod_t)
Update modules for file_t merge into unlabeled_t.
2014-01-16 16:24:25 +00:00
# for when /var is not mounted early in the boot:
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
kernel_dontaudit_search_unlabeled(kmod_t)
corecmd_exec_bin(kmod_t)
corecmd_exec_shell(kmod_t)
dev_rw_sysfs(kmod_t)
dev_search_usbfs(kmod_t)
dev_rw_mtrr(kmod_t)
dev_read_urand(kmod_t)
dev_rw_agp(kmod_t)
dev_read_sound(kmod_t)
dev_write_sound(kmod_t)
Rename apm to acpi from Russell Coker. This patch is slightly more involved than just running sed. It also adds typealias rules and doesn't change the FC entries. The /dev/apm_bios device doesn't exist on modern systems. I have left that policy in for the moment on the principle of making one change per patch. But I might send another patch to remove that as it won't exist with modern kernels.
2017-04-26 10:36:20 +00:00
dev_rw_acpi_bios(kmod_t)
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
domain_signal_all_domains(kmod_t)
domain_use_interactive_fds(kmod_t)
files/modutils: unify modules_object_t usage into files module modutils.te: 50: (W): No explicit declaration for modules_object_t from module files. You should access it via interface call or use a require block. (W-001) modutils.te: 51: (W): No explicit declaration for modules_object_t from module files. You should access it via interface call or use a require block. (W-001) modutils.te: 52: (W): No explicit declaration for modules_object_t from module files. You should access it via interface call or use a require block. (W-001) modutils.te: 53: (W): No explicit declaration for modules_object_t from module files. You should access it via interface call or use a require block. (W-001) modutils.if: 15: (W): Definition of declared type modules_object_t not found in own module, but in module files (W-011) modutils.if: 52: (W): Definition of declared type modules_object_t not found in own module, but in module files (W-011) modutils.fc: 24: (S): Type modules_object_t is declared in module files, but used in file context here. (S-002) Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2020-08-12 16:17:19 +00:00
files_manage_kernel_modules(kmod_t)
modutils: allow depmod to read /boot/System.map On a Debian system, when installing a package which provides a kernel module with DKMS, the module is compiled and depmod is executed with a command line that looks like: depmod -a 4.19.0-5-amd64 -F /boot/System.map-4.19.0-5-amd64 This obviously requires depmod to read System.map. Otherwise, the following events are logged to audit.log: type=AVC msg=audit(1567802614.408:138551): avc: denied { search } for pid=12090 comm="depmod" name="boot" dev="vda1" ino=262145 scontext=sysadm_u:sysadm_r:kmod_t tcontext=system_u:object_r:boot_t tclass=dir permissive=0 type=AVC msg=audit(1567802670.132:138555): avc: denied { read } for pid=14210 comm="depmod" name="System.map-4.19.0-5-amd64" dev="vda1" ino=262148 scontext=sysadm_u:sysadm_r:kmod_t tcontext=system_u:object_r:system_map_t tclass=file permissive=1 type=AVC msg=audit(1567802670.132:138555): avc: denied { open } for pid=14210 comm="depmod" path="/boot/System.map-4.19.0-5-amd64" dev="vda1" ino=262148 scontext=sysadm_u:sysadm_r:kmod_t tcontext=system_u:object_r:system_map_t tclass=file permissive=1 type=AVC msg=audit(1567802670.136:138556): avc: denied { getattr } for pid=14210 comm="depmod" path="/boot/System.map-4.19.0-5-amd64" dev="vda1" ino=262148 scontext=sysadm_u:sysadm_r:kmod_t tcontext=system_u:object_r:system_map_t tclass=file permissive=1 and depmod fails, which makes apt fails with: wireguard.ko: Running module version sanity check. - Original module - No original module exists within this kernel - Installation - Installing to /lib/modules/4.19.0-5-amd64/updates/dkms/ depmod...(bad exit status: 1) [...] Error! Problems with depmod detected. Automatically uninstalling this module. DKMS: Install Failed (depmod problems). Module rolled back to built state. dpkg: error processing package wireguard-dkms (--configure): installed wireguard-dkms package post-installation script subprocess returned error exit status 6 [...] Errors were encountered while processing: wireguard-dkms E: Sub-process /usr/bin/dpkg returned an error code (1) Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-06 21:03:19 +00:00
files_read_kernel_symbol_table(kmod_t)
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
files_read_etc_runtime_files(kmod_t)
files_read_etc_files(kmod_t)
files_read_usr_files(kmod_t)
files_exec_etc_files(kmod_t)
kmod, lvm, brctl patches from Russell Coker Patches for modutils, at least one of which is needed to generate an initramfs on Debian. Patch to allow lvm to talk to fifos from dpkg_script_t for postinst scripts etc. Patch for brctl to allow it to create sysfs files.
2017-04-19 01:17:36 +00:00
files_search_tmp(kmod_t)
add some file_t interfaces, and console write
2005-05-31 21:25:45 +00:00
# for nscd:
Update callers for "pid" to "runtime" interface rename. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-27 21:11:48 +00:00
files_dontaudit_search_runtime(kmod_t)
modutils: update to run in confined mode Update the modutils module so that it can run in confined mode instead of unconfined mode. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
2016-12-23 01:15:14 +00:00
# to manage modules.dep
files_manage_kernel_modules(kmod_t)
fix ordering in modutils.
2009-08-05 14:11:08 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
fs_getattr_xattr_fs(kmod_t)
fs_dontaudit_use_tmpfs_chr_dev(kmod_t)
tiny stuff for today Allow transition to dpkg_t with nnp, Dominick seems to imply this shouldn't be necessary. Lots of little stuff for system_cronjob_t. Other minor trivial changes that should be obvious.
2019-01-22 09:00:28 +00:00
fs_search_tracefs(kmod_t)
initial commit
2005-04-14 20:18:17 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
init_rw_initctl(kmod_t)
init_use_fds(kmod_t)
init_use_script_fds(kmod_t)
init_use_script_ptys(kmod_t)
more conversion due to new interfaces
2005-05-03 20:44:35 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
logging_send_syslog_msg(kmod_t)
logging_search_logs(kmod_t)
initial commit
2005-04-14 20:18:17 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
miscfiles_read_localization(kmod_t)
initial commit
2005-04-14 20:18:17 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
seutil_read_file_contexts(kmod_t)
patch from dan Fri, 27 Jan 2006 01:37:19 -0500
2006-01-27 20:13:08 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
userdom_use_user_terminals(kmod_t)
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
userdom_dontaudit_search_user_home_dirs(kmod_t)
trunk: add basic ubuntu support
2008-02-05 18:24:43 +00:00
system/modutils: Add kernel_search_key(kmod_t) This permission is currently granted in an ifdef(systemd) block, but it's also required on non-systemd systems if signed kernel modules are being used.
2016-11-27 16:41:45 +00:00
ifdef(`init_systemd',`
systemd-tmpfiles: refactor runtime configs handle runtime configuration files under /run/tmpfiles.d as 3rd party content, like /run or /var/lib
2017-02-18 21:16:30 +00:00
# for /run/tmpfiles.d/kmod.conf
allow kmod_t kmod_tmpfiles_conf_t:file manage_file_perms;
# kmod needs to create /run/tmpdiles.d
systemd_tmpfiles_creator(kmod_t)
Add supporting rules for domains tightly-coupled with systemd.
2015-10-20 18:48:38 +00:00
systemd-tmpfiles: refactor runtime configs handle runtime configuration files under /run/tmpfiles.d as 3rd party content, like /run or /var/lib
2017-02-18 21:16:30 +00:00
init_rw_stream_sockets(kmod_t)
Add supporting rules for domains tightly-coupled with systemd.
2015-10-20 18:48:38 +00:00
')
Iptables and modutils patches from Dan Walsh.
2009-12-01 14:23:11 +00:00
optional_policy(`
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
alsa_domtrans(kmod_t)
Iptables and modutils patches from Dan Walsh.
2009-12-01 14:23:11 +00:00
')
modutils: allow depmod and modprobe to use the I/O provided by apt On Debian, when installing a package which provides a kernel module with DKMS, depmod and modprobe are invoked using a dedicated pseudo-tty: type=AVC msg=audit(1567803320.004:138586): avc: denied { read write } for pid=19269 comm="depmod" path="/dev/pts/2" dev="devpts" ino=5 scontext=sysadm_u:sysadm_r:kmod_t tcontext=sysadm_u:object_r:apt_devpts_t tclass=chr_file permissive=1 type=AVC msg=audit(1567803320.664:138589): avc: denied { use } for pid=19276 comm="modprobe" path="/dev/pts/2" dev="devpts" ino=5 scontext=sysadm_u:sysadm_r:kmod_t tcontext=sysadm_u:sysadm_r:apt_t tclass=fd permissive=1 type=AVC msg=audit(1567803320.664:138589): avc: denied { append } for pid=19276 comm="modprobe" path="/dev/pts/2" dev="devpts" ino=5 scontext=sysadm_u:sysadm_r:kmod_t tcontext=sysadm_u:object_r:apt_devpts_t tclass=chr_file permissive=1 Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-06 21:08:24 +00:00
optional_policy(`
apt_use_fds(kmod_t)
apt_use_ptys(kmod_t)
')
kmod, lvm, brctl patches from Russell Coker Patches for modutils, at least one of which is needed to generate an initramfs on Debian. Patch to allow lvm to talk to fifos from dpkg_script_t for postinst scripts etc. Patch for brctl to allow it to create sysfs files.
2017-04-19 01:17:36 +00:00
optional_policy(`
Simple map patch from Russell Coker.
2018-02-15 22:10:34 +00:00
# for postinst of a new kernel package
kmod, lvm, brctl patches from Russell Coker Patches for modutils, at least one of which is needed to generate an initramfs on Debian. Patch to allow lvm to talk to fifos from dpkg_script_t for postinst scripts etc. Patch for brctl to allow it to create sysfs files.
2017-04-19 01:17:36 +00:00
dpkg_manage_script_tmp_files(kmod_t)
Simple map patch from Russell Coker.
2018-02-15 22:10:34 +00:00
dpkg_map_script_tmp_files(kmod_t)
dpkg: Rename dpkg_read_script_tmp_links().
2019-01-05 18:56:43 +00:00
dpkg_read_script_tmp_symlinks(kmod_t)
kmod, lvm, brctl patches from Russell Coker Patches for modutils, at least one of which is needed to generate an initramfs on Debian. Patch to allow lvm to talk to fifos from dpkg_script_t for postinst scripts etc. Patch for brctl to allow it to create sysfs files.
2017-04-19 01:17:36 +00:00
')
Iptables and modutils patches from Dan Walsh.
2009-12-01 14:23:11 +00:00
optional_policy(`
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
firstboot_dontaudit_rw_pipes(kmod_t)
firstboot_dontaudit_rw_stream_sockets(kmod_t)
Iptables and modutils patches from Dan Walsh.
2009-12-01 14:23:11 +00:00
')
optional_policy(`
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
hal_write_log(kmod_t)
Iptables and modutils patches from Dan Walsh.
2009-12-01 14:23:11 +00:00
')
deprecate module name as first parameter of optional_policy()
2006-03-24 16:13:54 +00:00
optional_policy(`
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
hotplug_search_config(kmod_t)
more updates
2005-09-15 21:03:29 +00:00
')
kmod, lvm, brctl patches from Russell Coker Patches for modutils, at least one of which is needed to generate an initramfs on Debian. Patch to allow lvm to talk to fifos from dpkg_script_t for postinst scripts etc. Patch for brctl to allow it to create sysfs files.
2017-04-19 01:17:36 +00:00
optional_policy(`
Update callers for "pid" to "runtime" interface rename. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-27 21:11:48 +00:00
iptables_dontaudit_read_runtime_files(kmod_t)
kmod, lvm, brctl patches from Russell Coker Patches for modutils, at least one of which is needed to generate an initramfs on Debian. Patch to allow lvm to talk to fifos from dpkg_script_t for postinst scripts etc. Patch for brctl to allow it to create sysfs files.
2017-04-19 01:17:36 +00:00
')
deprecate module name as first parameter of optional_policy()
2006-03-24 16:13:54 +00:00
optional_policy(`
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
mount_domtrans(kmod_t)
more insmod work, bring in depmod and update_modules
2005-04-20 21:00:01 +00:00
')
initial commit
2005-04-14 20:18:17 +00:00
deprecate module name as first parameter of optional_policy()
2006-03-24 16:13:54 +00:00
optional_policy(`
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
nis_use_ypbind(kmod_t)
add radvd, plus a few cleanups from sediff
2005-09-23 21:20:03 +00:00
')
deprecate module name as first parameter of optional_policy()
2006-03-24 16:13:54 +00:00
optional_policy(`
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
nscd_use(kmod_t)
more updates
2005-09-15 21:03:29 +00:00
')
deprecate module name as first parameter of optional_policy()
2006-03-24 16:13:54 +00:00
optional_policy(`
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
fs_manage_ramfs_files(kmod_t)
add rhgb
2006-03-09 19:02:29 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
rhgb_use_fds(kmod_t)
rhgb_dontaudit_use_ptys(kmod_t)
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
xserver_dontaudit_write_log(kmod_t)
xserver_stream_connect(kmod_t)
xserver_dontaudit_rw_stream_sockets(kmod_t)
add rhgb
2006-03-09 19:02:29 +00:00
')
deprecate module name as first parameter of optional_policy()
2006-03-24 16:13:54 +00:00
optional_policy(`
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
rpm_rw_pipes(kmod_t)
more cleanup of current TODOs
2005-07-12 20:34:24 +00:00
')
deprecate module name as first parameter of optional_policy()
2006-03-24 16:13:54 +00:00
optional_policy(`
TODO cleanup
2006-04-03 19:49:47 +00:00
# cjp: why is this needed:
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
dev_rw_xserver_misc(kmod_t)
TODO cleanup
2006-04-03 19:49:47 +00:00
single binary modutils On Tuesday, 2 August 2016 7:59:28 PM AEDT Chris PeBenito wrote: > On 07/31/16 08:34, Russell Coker wrote: > > The following patch deals with a single binary for modutils, so depmod_t, > > and insmod_t are merged. > > Since the main SELinux distros (including RHEL/CentOS 7) all have merged > modutils these days, I'm open to taking a patch that fully merges these > domains (in which case renaming to kmod_t, with proper aliasing seems > the best idea). > > However, it's been some time since I used a busybox-based system; does > busybox still have separated tools? Yes, this is a bit of an obvious > question since busybox is also single-binary, but IIRC, the embedded > guys made some tiny helper scripts or executables so proper > transitioning could occur. Separate domains may still make sense. As we have had no response from Busybox users in the last 3 months and also no response to the thread Luis started in 2013 I think it's safe to assume that they don't need this. I've attached a new patch which renames to kmod_t as you suggested. Please consider it for inclusion. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/ Description: Change modutils policy to match the use of a single binary Author: Russell Coker <russell@coker.com.au> Last-Update: 2014-06-25
2016-10-21 08:35:53 +00:00
xserver_getattr_log(kmod_t)
more upstream merging
2005-09-16 21:20:37 +00:00
')