RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

udev: Add watch perms 

Udev watches all the fixed_disks and udevadm watches the runtime dir.

udevd[3010]: inotify_add_watch(6, /dev/sde, 10) failed: Permission denied

avc:  denied  { watch } for  pid=4669 comm="udevadm" path="/run/udev" dev="tmpfs" ino=19464 scontext=system_u:system_r:udevadm_t:s0 tcontext=system_u:object_r:udev_runtime_t:s0 tclass=dir permissive=0
avc:  denied  { watch } for  pid=3022 comm="udevd" path="/dev/loop3" dev="devtmpfs" ino=10247 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=0
Signed-off-by: Jason Zaman <jason@perfinion.com>
This commit is contained in:
Jason Zaman 2020-02-17 04:03:11 +08:00 committed by Chris PeBenito
parent 124d3723d8
commit 1387160e0c
2 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
policy/modules/kernel/storage.if
View File

@ -364,6 +364,26 @@ interface(`storage_swapon_fixed_disk',`
allow $1 fixed_disk_device_t:blk_file getattr;
')
########################################
## <summary>
## Watch fixed disk device nodes.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`storage_watch_fixed_disk',`
gen_require(`
type fixed_disk_device_t;
')
dev_list_all_dev_nodes($1)
allow $1 fixed_disk_device_t:blk_file watch;
allow $1 fixed_disk_device_t:chr_file watch;
')
########################################
## <summary>
## Allow the caller to get the attributes

3
policy/modules/system/udev.te
View File

@ -154,6 +154,8 @@ selinux_compute_create_context(udev_t)
selinux_compute_relabel_context(udev_t)
selinux_compute_user_contexts(udev_t)
storage_watch_fixed_disk(udev_t)
auth_read_pam_console_data(udev_t)
auth_domtrans_pam_console(udev_t)
auth_use_nsswitch(udev_t)
@ -401,6 +403,7 @@ delete_files_pattern(udevadm_t, udev_runtime_t, udev_runtime_t)
delete_lnk_files_pattern(udevadm_t, udev_runtime_t, udev_runtime_t)
list_dirs_pattern(udevadm_t, udev_runtime_t, udev_runtime_t)
read_files_pattern(udevadm_t, udev_runtime_t, udev_runtime_t)
allow udevadm_t udev_runtime_t:dir watch;
list_dirs_pattern(udevadm_t, udev_tbl_t, udev_tbl_t)
read_files_pattern(udevadm_t, udev_tbl_t, udev_tbl_t)