From 7c356f97f5ea70786738c263ef5116a8b2aba0e7 Mon Sep 17 00:00:00 2001 From: Nicolas Iooss Date: Sat, 10 May 2014 16:45:24 +0200 Subject: [PATCH] Make unconfined user run lvm programs in confined domain When an unconfined user uses truecrypt to mount an encrypted file, dmsetup is called to setup a new device. This program works with udev to configure the new device and uses SysV semaphores to synchronize states. As udev runs dmsetup in lvm_t domain, the first dmsetup process needs to create lvm_t semaphores (not unconfined_t) and hence needs to run in lvm_t domain. More details are available in the archives on the ML: http://oss.tresys.com/pipermail/refpolicy/2014-May/007111.html --- policy/modules/system/unconfined.te | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te index 472a39ec3..79f29091e 100644 --- a/policy/modules/system/unconfined.te +++ b/policy/modules/system/unconfined.te @@ -107,6 +107,10 @@ optional_policy(` lpd_run_checkpc(unconfined_t, unconfined_r) ') +optional_policy(` + lvm_run(unconfined_t, unconfined_r) +') + optional_policy(` modutils_run_update_mods(unconfined_t, unconfined_r) ')