RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/services/tpm2.fc

7 lines
348 B
Plaintext
Raw Normal View History

Label programs in /usr/bin like /usr/sbin Some recent modifications added patterns in .fc files for programs in /usr/sbin without adding the patterns for /usr/bin. On Arch Linux, where /usr/sbin is a symlink to /usr/bin, such patterns are never matched. Add the missing patterns. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-04 20:25:25 +00:00
/usr/bin/tpm2-abrmd -- gen_context(system_u:object_r:tpm2_abrmd_exec_t,s0)
Setup domain for tpm2_* binaries The various /bin/tpm2_* binaries use dbus to communicate with tpm2-abrmd and also can directly access /dev/tpmrm0. This seems like a way to help limit access to the TPM by running the tpm_* binaries in their own domain. I setup this domain because I have a process that needs to use tpm2_hmac to encode something, but didn't want that domain to have direct access to the TPM. I did some basic testing to verify that the other tpm2_* binaries have basically the same access needs. But it wasn't through testing of all the tpm2_* binaries. Signed-off-by: Dave Sugar <dsugar@tresys.com>
2020-03-29 00:21:33 +00:00
/usr/bin/tpm2_[^/]+ -- gen_context(system_u:object_r:tpm2_exec_t,s0)
Label programs in /usr/bin like /usr/sbin Some recent modifications added patterns in .fc files for programs in /usr/sbin without adding the patterns for /usr/bin. On Arch Linux, where /usr/sbin is a symlink to /usr/bin, such patterns are never matched. Add the missing patterns. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-09-04 20:25:25 +00:00
Module for tpm2 Module for tpm2 v2 - updated to rename module and interface names, different dbus interface Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-08-05 19:13:02 +00:00
/usr/sbin/tpm2-abrmd -- gen_context(system_u:object_r:tpm2_abrmd_exec_t,s0)
/usr/lib/systemd/system/[^/]*tpm2-abrmd\.service -- gen_context(system_u:object_r:tpm2_abrmd_unit_t,s0)