RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make unconfined user run lvm programs in confined domain 

When an unconfined user uses truecrypt to mount an encrypted file, dmsetup is
called to setup a new device.  This program works with udev to configure the
new device and uses SysV semaphores to synchronize states.  As udev runs
dmsetup in lvm_t domain, the first dmsetup process needs to create lvm_t
semaphores (not unconfined_t) and hence needs to run in lvm_t domain.

More details are available in the archives on the ML:
http://oss.tresys.com/pipermail/refpolicy/2014-May/007111.html
This commit is contained in:
Nicolas Iooss 2014-05-10 16:45:24 +02:00 committed by Chris PeBenito
parent 1c8c76c927
commit 7c356f97f5
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
policy/modules/system/unconfined.te
View File

@ -107,6 +107,10 @@ optional_policy(`
lpd_run_checkpc(unconfined_t, unconfined_r)
')
optional_policy(`
lvm_run(unconfined_t, unconfined_r)
')
optional_policy(`
modutils_run_update_mods(unconfined_t, unconfined_r)
')