diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index 0695d471b..d953f0452 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -1160,7 +1160,7 @@ optional_policy(` ') optional_policy(` - udevadm_run(sysadm_t, sysadm_r) + udev_run_udevadm(sysadm_t, sysadm_r) ') optional_policy(` diff --git a/policy/modules/system/udev.fc b/policy/modules/system/udev.fc index f02e8195a..c88189fb7 100644 --- a/policy/modules/system/udev.fc +++ b/policy/modules/system/udev.fc @@ -6,7 +6,7 @@ /etc/udev/scripts/.+ -- gen_context(system_u:object_r:udev_helper_exec_t,s0) /usr/bin/udev -- gen_context(system_u:object_r:udev_exec_t,s0) -/usr/bin/udevadm -- gen_context(system_u:object_r:udevadm_exec_t,s0) +/usr/bin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0) /usr/bin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0) /usr/bin/udevinfo -- gen_context(system_u:object_r:udev_exec_t,s0) /usr/bin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0) @@ -18,7 +18,7 @@ ifdef(`distro_debian',` ') /usr/sbin/udev -- gen_context(system_u:object_r:udev_exec_t,s0) -/usr/sbin/udevadm -- gen_context(system_u:object_r:udevadm_exec_t,s0) +/usr/sbin/udevadm -- gen_context(system_u:object_r:udev_exec_t,s0) /usr/sbin/udevd -- gen_context(system_u:object_r:udev_exec_t,s0) /usr/sbin/udevsend -- gen_context(system_u:object_r:udev_exec_t,s0) /usr/sbin/udevstart -- gen_context(system_u:object_r:udev_exec_t,s0) diff --git a/policy/modules/system/udev.if b/policy/modules/system/udev.if index c75353171..538f28514 100644 --- a/policy/modules/system/udev.if +++ b/policy/modules/system/udev.if @@ -514,12 +514,49 @@ interface(`udev_manage_runtime_files',` ## ## # -interface(`udevadm_domtrans',` +interface(`udev_domtrans_udevadm',` gen_require(` - type udevadm_t, udevadm_exec_t; + type udevadm_t, udev_exec_t; ') - domtrans_pattern($1, udevadm_exec_t, udevadm_t) + domtrans_pattern($1, udev_exec_t, udevadm_t) +') + +######################################## +## +## Execute udev admin in the udevadm domain. (Deprecated) +## +## +## +## Domain allowed to transition. +## +## +# +interface(`udevadm_domtrans',` + refpolicywarn(`$0($*) has been deprecated, use udev_domtrans_udevadm() instead.') + udev_domtrans_udevadm($1) +') + +######################################## +## +## Execute udevadm in the udevadm domain, and +## allow the specified role the udevadm domain. (Deprecated) +## +## +## +## Domain allowed to transition. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`udevadm_run',` + refpolicywarn(`$0($*) has been deprecated, use udev_run_udevadm() instead.') + udev_run_udevadm($1, $2) ') ######################################## @@ -539,15 +576,30 @@ interface(`udevadm_domtrans',` ## ## # -interface(`udevadm_run',` +interface(`udev_run_udevadm',` gen_require(` attribute_role udevadm_roles; ') - udevadm_domtrans($1) + udev_domtrans_udevadm($1) roleattribute $2 udevadm_roles; ') +######################################## +## +## Execute udevadm in the caller domain. (Deprecated) +## +## +## +## Domain allowed access. +## +## +# +interface(`udevadm_exec',` + refpolicywarn(`$0($*) has been deprecated, use udev_exec_udevadm() instead.') + udev_exec_udevadm($1) +') + ######################################## ## ## Execute udevadm in the caller domain. @@ -558,10 +610,10 @@ interface(`udevadm_run',` ## ## # -interface(`udevadm_exec',` +interface(`udev_exec_udevadm',` gen_require(` - type udevadm_exec_t; + type udev_exec_t; ') - can_exec($1, udevadm_exec_t) + can_exec($1, udev_exec_t) ') diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te index 387032fdd..13cbed59c 100644 --- a/policy/modules/system/udev.te +++ b/policy/modules/system/udev.te @@ -7,7 +7,7 @@ policy_module(udev, 1.28.1) attribute_role udevadm_roles; type udev_t; -type udev_exec_t; +type udev_exec_t alias udevadm_exec_t; type udev_helper_exec_t; kernel_domtrans_to(udev_t, udev_exec_t) domain_obj_id_change_exemption(udev_t) @@ -17,9 +17,7 @@ init_daemon_domain(udev_t, udev_exec_t) init_named_socket_activation(udev_t, udev_runtime_t) type udevadm_t; -type udevadm_exec_t; -init_system_domain(udevadm_t, udevadm_exec_t) -application_domain(udevadm_t, udevadm_exec_t) +application_domain(udevadm_t, udev_exec_t) role udevadm_roles types udevadm_t; type udev_etc_t alias etc_udev_t;