From 1a3baa342cffb39dd888fd3d6b69c0beb5c498ed Mon Sep 17 00:00:00 2001 From: Nicolas Iooss Date: Sat, 15 Apr 2017 20:23:34 +0200 Subject: [PATCH] Synchronize file patterns for /usr/bin/mount... and /usr/sbin/mount... mount.fc defines file contexts for /usr/bin/mount.*, /usr/bin/umount.* and /usr/sbin/mount\.zfs. These patterns are not consistent for two reasons: - some distributions use /sbin/mount... for other file systems that zfs. For example Debian uses /sbin/mount.ntfs-3g (https://packages.debian.org/jessie/amd64/ntfs-3g/filelist) - mount_exec_t type should only be applied to mount, umount, mount.$FS and umount.udisks2, not mountpoint. Replace the file patterns with ones that do not match mountpoint and match every mount and umount programs in /usr/bin and /usr/sbin. --- policy/modules/system/mount.fc | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/policy/modules/system/mount.fc b/policy/modules/system/mount.fc index 39ea6f5ca..97e2596b1 100644 --- a/policy/modules/system/mount.fc +++ b/policy/modules/system/mount.fc @@ -1,8 +1,9 @@ /usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/bin/mount.* -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/bin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/bin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) -/usr/sbin/mount\.zfs -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/sbin/mount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) +/usr/sbin/umount(\.[^/]+)? -- gen_context(system_u:object_r:mount_exec_t,s0) /usr/sbin/zfs -- gen_context(system_u:object_r:mount_exec_t,s0) /usr/sbin/zpool -- gen_context(system_u:object_r:mount_exec_t,s0)