RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add mount_var_run_t type and allow mount_t domain to manage the files and directories 

In Debian, mount store some information (a utab file) under
/var/run/mount directory.

This is inspired by the fedora policy.
This commit is contained in:
Laurent Bigonville 2013-01-12 22:32:26 +01:00 committed by Chris PeBenito
parent ef854630b4
commit 693532ae68
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/system/mount.fc
View File

@ -2,3 +2,5 @@
/bin/umount.* -- gen_context(system_u:object_r:mount_exec_t,s0)
/usr/bin/fusermount -- gen_context(system_u:object_r:mount_exec_t,s0)
/var/run/mount(/.*)? gen_context(system_u:object_r:mount_var_run_t,s0)

8
policy/modules/system/mount.te
View File

@ -26,6 +26,9 @@ files_type(mount_loopback_t)
type mount_tmp_t;
files_tmp_file(mount_tmp_t)
type mount_var_run_t;
files_pid_file(mount_var_run_t)
# causes problems with interfaces when
# this is optionally declared in monolithic
# policy--duplicate type declaration
@ -49,6 +52,11 @@ can_exec(mount_t, mount_exec_t)
files_tmp_filetrans(mount_t, mount_tmp_t, { file dir })
create_dirs_pattern(mount_t, mount_var_run_t, mount_var_run_t)
create_files_pattern(mount_t, mount_var_run_t, mount_var_run_t)
rw_files_pattern(mount_t, mount_var_run_t, mount_var_run_t)
files_pid_filetrans(mount_t, mount_var_run_t, dir, "mount")
kernel_read_system_state(mount_t)
kernel_read_kernel_sysctls(mount_t)
kernel_dontaudit_getattr_core_if(mount_t)