RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/udev.fc

45 lines
2.0 KiB
Plaintext
Raw Normal View History

Reverse /dev/.udev/(/.*)? dir label fix. I realized the policy wasn't complete for handling udev_tbl_t dirs, and updating it wouldn't work because we couldn't make a filetrans on dirs, since all the dirs in /dev would become udev_tbl_t. i.e. this would have been required, but would make problems: dev_filetrans(udev_t, udev_tbl_t, dir);
2011-02-17 14:32:00 +00:00
/dev/\.udev(/.*)? -- gen_context(system_u:object_r:udev_tbl_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/dev/\.udevdb -- gen_context(system_u:object_r:udev_tbl_t,s0)
/dev/udev\.tbl -- gen_context(system_u:object_r:udev_tbl_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/dev\.d/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/hotplug\.d/default/udev.* -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Remove unescaped single dot from the policy In a pattern, a dot can match any character, including slash. It makes sense when it is combined with ?, + or *, but makes little sense when left alone. Most of the time, the label was for file containing dots, where the dot was not escaped. A few times, the dot was really intended to match any character. In such case, [^/] better suits the intent. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-08-27 21:38:09 +00:00
/etc/udev/rules\.d(/.*)? gen_context(system_u:object_r:udev_rules_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
initial commit
2005-05-10 19:51:00 +00:00
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
Separate out udevadm into a new domain This is the update I have made based on suggestions for the previous patches to add a udev_run interface. This adds the new domain udevadm_t which is entered from /usr/bin/udevadm. It seems to meet the needs that I have, but there are some things to note that are probably important. 1) There are a few systemd services that use udevadm during startup. I have granted the permisssions that I need based on denials I was seeing during startup (the machine would fail to start without the permisions). 2) In the udev.fc file there are other binaries that I don't have on a RHEL7 box that maybe should also be labeled udevadm_exec_t. e.g. /usr/bin/udevinfo and /usr/bin/udevsend But as I don't have those binaries to test, I have not updated the type of that binary. 3) There are some places that call udev_domtrans that maybe should now be using udevadm_domtrans - rpm.te, hal.te, hotplug.te. Again, these are not things that I am using in my current situation and am unable to test the interactions to know if the change is correct. Other than that, I think this was a good suggestion to split udevadm into a different domain. Only change for v4 is to use stream_connect_pattern as suggested. Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-03-15 02:27:10 +00:00
/usr/bin/udevadm -- gen_context(system_u:object_r:udevadm_exec_t,s0)
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/udevstart -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/bin/wait_for_sysfs -- gen_context(system_u:object_r:udev_exec_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_debian',`
/usr/lib/udev/create_static_nodes -- gen_context(system_u:object_r:udev_exec_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
')
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0)
Separate out udevadm into a new domain This is the update I have made based on suggestions for the previous patches to add a udev_run interface. This adds the new domain udevadm_t which is entered from /usr/bin/udevadm. It seems to meet the needs that I have, but there are some things to note that are probably important. 1) There are a few systemd services that use udevadm during startup. I have granted the permisssions that I need based on denials I was seeing during startup (the machine would fail to start without the permisions). 2) In the udev.fc file there are other binaries that I don't have on a RHEL7 box that maybe should also be labeled udevadm_exec_t. e.g. /usr/bin/udevinfo and /usr/bin/udevsend But as I don't have those binaries to test, I have not updated the type of that binary. 3) There are some places that call udev_domtrans that maybe should now be using udevadm_domtrans - rpm.te, hal.te, hotplug.te. Again, these are not things that I am using in my current situation and am unable to test the interactions to know if the change is correct. Other than that, I think this was a good suggestion to split udevadm into a different domain. Only change for v4 is to use stream_connect_pattern as suggested. Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-03-15 02:27:10 +00:00
/usr/sbin/udevadm -- gen_context(system_u:object_r:udevadm_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/udevstart -- gen_context(system_u:object_r:udev_exec_t,s0)
/usr/sbin/wait_for_sysfs -- gen_context(system_u:object_r:udev_exec_t,s0)
Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker.
2017-02-04 20:19:35 +00:00
ifdef(`distro_redhat',`
/usr/sbin/start_udev -- gen_context(system_u:object_r:udev_exec_t,s0)
')
Minor whitespace fix in udev.fc
2012-08-08 13:30:09 +00:00
/usr/lib/systemd/systemd-udevd -- gen_context(system_u:object_r:udev_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/lib/udev/udev-acl -- gen_context(system_u:object_r:udev_exec_t,s0)
New location for udevd binary Recent udev installs its main binary in /usr/lib/systemd (called systemd-udevd). Update file contexts to support this. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-07-25 11:41:19 +00:00
Label /usr/share/virtualbox/VBoxCreateUSBNode.sh as udev_helper_exec_t VBoxCreateUSBNode.sh creates character special files in /dev/vboxusb each time a new USB device appears. This script is called by udev. audit.log on a system in permissive mode before this patch contains: type=AVC msg=audit(1396889711.890:175): avc: denied { execute } for pid=26284 comm="systemd-udevd" name="VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file type=AVC msg=audit(1396889711.890:175): avc: denied { execute_no_trans } for pid=26284 comm="systemd-udevd" path="/usr/share/virtualbox/VBoxCreateUSBNode.sh" dev="sda5" ino=5899405 scontext=system_u:system_r:udev_t tcontext=unconfined_u:object_r:usr_t tclass=file
2014-04-14 21:28:00 +00:00
/usr/share/virtualbox/VBoxCreateUSBNode\.sh -- gen_context(system_u:object_r:udev_helper_exec_t,s0)
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/udev(/.*)? gen_context(system_u:object_r:udev_runtime_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
ifdef(`distro_debian',`
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/xen-hotplug -d gen_context(system_u:object_r:udev_runtime_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
')