RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

systemd: allow reading options from EFI variable SystemdOptions 

Since systemd 244, systemd can parse EFI variable
SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67 like /proc/cmdline
in order to find options. systemd's NEWS file [1] states:

    systemd will also read configuration options from the EFI variable
    SystemdOptions. This may be used to configure systemd behaviour when
    modifying the kernel command line is inconvenient, but configuration
    on disk is read too late, for example for the options related to
    cgroup hierarchy setup. 'bootctl systemd-efi-options' may be used to
    set the EFI variable.

In practice, all callers of log_parse_environment() read this EFI
variable, because:

* log_parse_environment() is a macro which is expanded to
  log_parse_environment_realm(LOG_REALM) [2].
* log_parse_environment_realm() calls proc_cmdline_parse() when being
  use in system daemons [3].
* proc_cmdline_parse() always calls systemd_efi_options_variable() [4].
* systemd_efi_options_variable() reads SystemdOptions variable [5].

For SELinux, this means that every domain with attribute
systemd_log_parse_env_type wants to read an EFI variable. Allow this
access.

[1] https://github.com/systemd/systemd/blob/v244/NEWS#L18-L23
[2] https://github.com/systemd/systemd/blob/v244/src/basic/log.h#L84
[3] https://github.com/systemd/systemd/blob/v244/src/basic/log.c#L1116
[4] https://github.com/systemd/systemd/blob/v244/src/basic/proc-cmdline.c#L122
[5] https://github.com/systemd/systemd/blob/v244/src/basic/efivars.c#L242

Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
This commit is contained in:
Nicolas Iooss 2019-12-30 18:01:43 +01:00
parent cb5e78abe7
commit c8af923318
No known key found for this signature in database
GPG Key ID: C191415F340DAAA0
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/system/systemd.te
View File

@ -416,6 +416,9 @@ kernel_read_system_state(systemd_log_parse_env_type)
dev_write_kmsg(systemd_log_parse_env_type) dev_write_kmsg(systemd_log_parse_env_type)
# For /sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67
fs_read_efivarfs_files(systemd_log_parse_env_type)
term_use_console(systemd_log_parse_env_type) term_use_console(systemd_log_parse_env_type)
init_read_state(systemd_log_parse_env_type) init_read_state(systemd_log_parse_env_type)