RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

policy for systemd-hwdb 

systemd-hwdb rebuilds /etc/udev/hwdb.bin from files in /var/lib/udev/hwdb.d/*
making a temp file first in /etc/udev/ then moving the tmp file
over hwdb.bin when complete.  It also relabels based in file_contexts
This provides private type for /etc/udev/hwdb.bin

Signed-off-by: Dave Sugar <dsugar@tresys.com>
This commit is contained in:
Dave Sugar 2018-06-07 15:19:40 -04:00 committed by Chris PeBenito
parent 2408d45a3d
commit f4713393ae
4 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
policy/modules/system/systemd.fc
View File

@ -4,6 +4,7 @@
/usr/bin/systemd-cgtop -- gen_context(system_u:object_r:systemd_cgtop_exec_t,s0)
/usr/bin/systemd-coredump -- gen_context(system_u:object_r:systemd_coredump_exec_t,s0)
/usr/bin/systemd-detect-virt -- gen_context(system_u:object_r:systemd_detect_virt_exec_t,s0)
/usr/bin/systemd-hwdb -- gen_context(system_u:object_r:systemd_hw_exec_t,s0)
/usr/bin/systemd-nspawn -- gen_context(system_u:object_r:systemd_nspawn_exec_t,s0)
/usr/bin/systemd-run -- gen_context(system_u:object_r:systemd_run_exec_t,s0)
/usr/bin/systemd-stdio-bridge -- gen_context(system_u:object_r:systemd_stdio_bridge_exec_t,s0)
@ -40,6 +41,8 @@
/usr/lib/systemd/system/systemd-binfmt.* -- gen_context(system_u:object_r:systemd_binfmt_unit_t,s0)
/usr/lib/systemd/system/systemd-networkd.* gen_context(system_u:object_r:systemd_networkd_unit_t,s0)
/etc/udev/hwdb.bin -- gen_context(system_u:object_r:systemd_hwdb_t,s0)
/var/lib/systemd/backlight(/.*)? gen_context(system_u:object_r:systemd_backlight_var_lib_t,s0)
/var/lib/systemd/coredump(/.*)? gen_context(system_u:object_r:systemd_coredump_var_lib_t,s0)
/var/lib/systemd/linger(/.*)? gen_context(system_u:object_r:systemd_logind_var_lib_t,s0)

19
policy/modules/system/systemd.if
View File

@ -772,5 +772,24 @@ interface(`systemd_getattr_updated_runtime',`
')
#######################################
## <summary>
## Allow domain to read udev hwdb file
## </summary>
## <param name="domain">
## <summary>
## domain allowed access
## </summary>
## </param>
#
interface(`systemd_read_hwdb',`
gen_require(`
type systemd_hwdb_t;
')
read_files_pattern($1, systemd_hwdb_t, systemd_hwdb_t)
')

24
policy/modules/system/systemd.te
View File

@ -81,6 +81,13 @@ type systemd_hostnamed_t;
type systemd_hostnamed_exec_t;
init_daemon_domain(systemd_hostnamed_t, systemd_hostnamed_exec_t)
type systemd_hw_t;
type systemd_hw_exec_t;
init_system_domain(systemd_hw_t, systemd_hw_exec_t)
type systemd_hwdb_t;
files_type(systemd_hwdb_t);
type systemd_journal_t;
files_type(systemd_journal_t)
logging_log_file(systemd_journal_t)
@ -322,6 +329,23 @@ optional_policy(`
networkmanager_dbus_chat(systemd_hostnamed_t)
')
#########################################
#
# hw local policy
#
allow systemd_hw_t systemd_hwdb_t:file { manage_file_perms relabelfrom relabelto };
files_etc_filetrans(systemd_hw_t, systemd_hwdb_t, file)
files_search_pids(systemd_hw_t)
init_read_state(systemd_hw_t)
selinux_get_fs_mount(systemd_hw_t)
seutil_read_config(systemd_hw_t)
seutil_read_file_contexts(systemd_hw_t)
#######################################
#
# locale local policy

1
policy/modules/system/udev.te
View File

@ -248,6 +248,7 @@ ifdef(`init_systemd',`
init_get_generic_units_status(udev_t)
init_stream_connect(udev_t)
systemd_read_hwdb(udev_t)
systemd_read_logind_sessions_files(udev_t)
systemd_read_logind_pids(udev_t)