From c0c635b3f3ccb6a37329d11c9e96ed0720a46277 Mon Sep 17 00:00:00 2001 From: Dominick Grift Date: Mon, 7 Jun 2010 20:17:14 +0200 Subject: [PATCH] cgroup in filesystem. Move cgroup_t declarations from kernel.te to filesystem.te Redo cgroup interfaces in filesystem.if Add file context specification for /cgroup mountpoint to filesystem.fc Signed-off-by: Dominick Grift Signed-off-by: Chris PeBenito --- policy/modules/kernel/filesystem.fc | 2 + policy/modules/kernel/filesystem.if | 300 +++++++++++++++++----------- policy/modules/kernel/filesystem.te | 6 + policy/modules/kernel/kernel.te | 9 - 4 files changed, 191 insertions(+), 126 deletions(-) diff --git a/policy/modules/kernel/filesystem.fc b/policy/modules/kernel/filesystem.fc index b029773ac..9306de60e 100644 --- a/policy/modules/kernel/filesystem.fc +++ b/policy/modules/kernel/filesystem.fc @@ -1 +1,3 @@ /dev/shm -d gen_context(system_u:object_r:tmpfs_t,s0) + +/cgroup -d gen_context(system_u:object_r:cgroup_t,s0) diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index a2c146b96..4052ab906 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -559,7 +559,25 @@ interface(`fs_register_binary_executable_type',` ######################################## ## -## Mount a cgroup filesystem. +## Get attributes of cgroup filesystems. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_getattr_cgroup',` + gen_require(` + type cgroup_t; + ') + + allow $1 cgroup_t:filesystem getattr; +') + +######################################## +## +## Mount cgroup filesystems. ## ## ## @@ -577,8 +595,25 @@ interface(`fs_mount_cgroup', ` ######################################## ## -## Remount a cgroup filesystem This allows -## some mount options to be changed. +## Mount on cgroup directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_mounton_cgroup', ` + gen_require(` + type cgroup_t; + ') + + allow $1 cgroup_t:dir mounton; +') + +######################################## +## +## Remount cgroup filesystems. ## ## ## @@ -596,7 +631,7 @@ interface(`fs_remount_cgroup', ` ######################################## ## -## Unmount a cgroup file system. +## Unmount cgroup filesystems. ## ## ## @@ -614,41 +649,171 @@ interface(`fs_unmount_cgroup', ` ######################################## ## -## Get the attributes of a cgroup filesystem. +## Delete cgroup directories. ## ## ## ## Domain allowed access. ## ## -## # -interface(`fs_getattr_cgroup',` +interface(`fs_delete_cgroup_dirs', ` gen_require(` - type cifs_t; + type cgroup_t; ') - allow $1 cifs_t:filesystem getattr; + delete_dirs_pattern($1, cgroup_t, cgroup_t) ') ######################################## ## -## list dirs on cgroup -## file systems. +## list cgroup directories. ## ## -## -## Domain allowed access. -## +## +## Domain allowed access. +## ## # interface(`fs_list_cgroup_dirs', ` - gen_require(` - type cgroup_t; + gen_require(` + type cgroup_t; + ') - ') + list_dirs_pattern($1, cgroup_t, cgroup_t) +') - list_dirs_pattern($1, cgroup_t, cgroup_t) +######################################## +## +## Manage cgroup directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_manage_cgroup_dirs',` + gen_require(` + type cgroup_t; + + ') + + manage_dirs_pattern($1, cgroup_t, cgroup_t) +') + +######################################## +## +## Search cgroup directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_search_cgroup_dirs',` + gen_require(` + type cgroup_t; + + ') + + search_dirs_pattern($1, cgroup_t, cgroup_t) +') + +######################################## +## +## Manage cgroup files. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_manage_cgroup_files',` + gen_require(` + type cgroup_t; + + ') + + manage_files_pattern($1, cgroup_t, cgroup_t) +') + +######################################## +## +## Read cgroup files. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_read_cgroup_files',` + gen_require(` + type cgroup_t; + + ') + + read_files_pattern($1, cgroup_t, cgroup_t) +') + +######################################## +## +## Read and write cgroup files. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_rw_cgroup_files',` + gen_require(` + type cgroup_t; + + ') + + rw_files_pattern($1, cgroup_t, cgroup_t) +') + +######################################## +## +## Write cgroup files. +## +## +## +## Domain allowed access. +## +## +# +interface(`fs_write_cgroup_files', ` + gen_require(` + type cgroup_t; + ') + + write_files_pattern($1, cgroup_t, cgroup_t) +') + +######################################## +## +## Do not audit attempts to open, +## get attributes, read and write +## cgroup files. +## +## +## +## Domain to not audit. +## +## +# +interface(`fs_dontaudit_rw_cgroup_files',` + gen_require(` + type cgroup_t; + ') + + dontaudit $1 cgroup_t:file rw_file_perms; ') ######################################## @@ -670,105 +835,6 @@ interface(`fs_dontaudit_list_cifs_dirs',` dontaudit $1 cifs_t:dir list_dir_perms; ') -######################################## -## -## Manage dirs on cgroup file systems. -## -## -## -## Domain allowed access. -## -## -# -interface(`fs_manage_cgroup_dirs',` - gen_require(` - type cgroup_t; - - ') - - manage_dirs_pattern($1, cgroup_t, cgroup_t) -') - -######################################## -## -## Set attributes of files on cgroup -## file systems. -## -## -## -## Domain allowed access. -## -## -# -interface(`fs_setattr_cgroup_files',` - gen_require(` - type cgroup_t; - - ') - - setattr_files_pattern($1, cgroup_t, cgroup_t) -') - -######################################## -## -## Read files on cgroup -## file systems. -## -## -## -## Domain allowed access. -## -## -# -interface(`fs_read_cgroup_files',` - gen_require(` - type cgroup_t; - - ') - - read_files_pattern($1, cgroup_t, cgroup_t) -') - -######################################## -## -## Write files on cgroup -## file systems. -## -## -## -## Domain allowed access. -## -## -# -interface(`fs_write_cgroup_files', ` - gen_require(` - type cgroup_t; - - ') - - write_files_pattern($1, cgroup_t, cgroup_t) -') - -######################################## -## -## Read and write files on cgroup -## file systems. -## -## -## -## Domain allowed access. -## -## -# -interface(`fs_rw_cgroup_files',` - gen_require(` - type cgroup_t; - - ') - - rw_files_pattern($1, cgroup_t, cgroup_t) -') - ######################################## ## ## Mount a CIFS or SMB network filesystem. diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te index 774e0a150..cb889c348 100644 --- a/policy/modules/kernel/filesystem.te +++ b/policy/modules/kernel/filesystem.te @@ -68,6 +68,12 @@ fs_type(capifs_t) files_mountpoint(capifs_t) genfscon capifs / gen_context(system_u:object_r:capifs_t,s0) +type cgroup_t; +fs_type(cgroup_t) +files_type(cgroup_t) +files_mountpoint(cgroup_t) +genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0) + type configfs_t; fs_type(configfs_t) genfscon configfs / gen_context(system_u:object_r:configfs_t,s0) diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index b0b461748..5b7ffc0a6 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -45,15 +45,6 @@ mls_rangetrans_source(kernel_t) role system_r types kernel_t; sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh) -# -# cgroup fs -# - -type cgroup_t; -fs_type(cgroup_t) -allow cgroup_t self:filesystem associate; -genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0) - # # DebugFS #