RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Synchronize file patterns for /usr/bin/mount... and /usr/sbin/mount... 

mount.fc defines file contexts for /usr/bin/mount.*, /usr/bin/umount.*
and /usr/sbin/mount\.zfs. These patterns are not consistent for two
reasons:

- some distributions use /sbin/mount... for other file systems that zfs.
  For example Debian uses /sbin/mount.ntfs-3g
  (https://packages.debian.org/jessie/amd64/ntfs-3g/filelist)
- mount_exec_t type should only be applied to mount, umount, mount.$FS
  and umount.udisks2, not mountpoint.

Replace the file patterns with ones that do not match mountpoint and
match every mount and umount programs in /usr/bin and /usr/sbin.
This commit is contained in:
Nicolas Iooss 2017-04-15 20:23:34 +02:00
parent 466286aa39
commit 1a3baa342c
No known key found for this signature in database
GPG Key ID: C191415F340DAAA0
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
policy/modules/system/mount.fc
View File

@ -1,8 +1,9 @@
/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/bin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/bin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/sbin/mount\.zfs -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/sbin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/sbin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/sbin/zfs -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/sbin/zpool -- gen_context(system_u:object_r:mount_exec_t,s0)