d387e79989
Bump module versions for release.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-08-18 09:09:10 -04:00
613708cad6
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-07-04 09:30:45 -04:00
0992763548
Update callers for "pid" to "runtime" interface rename.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-06-28 16:03:45 -04:00
41963e7116
init, devicekit: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-04-09 10:12:38 -04:00
8982ce5945
Don't allow creating regular files in /dev
...
Init, init scripts and udisks don't need to be able to create regular
files in /dev.
Thanks to Jarkko Sakkinen for the idea.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-04-07 23:03:16 +03:00
b2cc317a64
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-03-19 14:07:12 -04:00
bfb4e60edb
Make raw memory access tunable
...
Modern systems shouldn't need direct access to raw memory
devices (/dev/mem, /dev/kmem, /dev/mergemem, dev/oldmem, /dev/port)
anymore, so let's remove the access in most cases and make it tunable
in the rest.
Add dev_read_raw_memory_cond(), dev_write_raw_memory_cond() and
dev_wx_raw_memory_cond(), which are conditional to new boolean
allow_raw_memory_access.
Remove raw memory access for a few domains that should never have
needed it (colord_t, iscsid_t, mdamd_t, txtstat_t), should not need it
anymore (dmidecode_t, Debian devicekit_diskt_t, hald_t, hald_mac_t,
xserver_t) or the domains that should transition to different domain
for this (rpm_t, kudzu_t, dpkg_t).
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
2020-03-16 14:06:16 +02:00
b2f72e833b
Bump module versions for release.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-02-29 16:54:39 -05:00
2400f6a74c
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2020-02-17 13:34:06 -05:00
dd84b117e2
policykit devicekit: Add watch perms
...
avc: denied { watch } for pid=12488 comm="gmain" path="/etc" dev="zfs" ino=1436 scontext=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0
avc: denied { watch } for pid=6452 comm="gmain" path="/run/ConsoleKit" dev="tmpfs" ino=17611 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:consolekit_runtime_t:s0 tclass=dir permissive=0
avc: denied { watch } for pid=6452 comm="gmain" path="/usr/share/polkit-1/actions" dev="zfs" ino=235638 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0
avc: denied { watch } for pid=6452 comm="gmain" path="/etc/polkit-1/rules.d" dev="zfs" ino=268215 scontext=system_u:system_r:policykit_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0
Signed-off-by: Jason Zaman <jason@perfinion.com>
2020-02-17 13:25:59 -05:00
cb5e78abe7
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-12-26 12:21:07 -05:00
deb69b3b65
devicekit: udisks needs access to /run/mount/utab.lock
...
type=AVC msg=audit(1563073723.106:232): avc: denied { read } for pid=7850 comm="udisksd" name="utab.lock" dev="tmpfs" ino=18445 scontext=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 tcontext=system_u:object_r:mount_runtime_t:s0 tclass=file permissive=0
type=SYSCALL msg=audit(1563073723.106:232): arch=c000003e syscall=254 success=no exit=-13 a0=b a1=55841d66c920 a2=10 a3=0 items=1 ppid=7849 pid=7850 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="udisksd" exe="/usr/libexec/udisks2/udisksd" subj=system_u:system_r:devicekit_disk_t:s0-s0:c0.c1023 key=(null)
type=CWD msg=audit(1563073723.106:232): cwd="/"
type=PATH msg=audit(1563073723.106:232): item=0 name="/run/mount/utab.lock" inode=18445 dev=00:16 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:mount_runtime_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
Signed-off-by: Jason Zaman <jason@perfinion.com>
2019-12-26 12:08:25 -05:00
291f68a119
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-30 20:39:31 -04:00
d6c7154f1c
Reorder declarations based on *_runtime_t renaming.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-30 20:02:43 -04:00
69a403cd97
Rename *_var_run_t types to *_runtime_t.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-30 20:02:43 -04:00
8c3893e427
Bump module versions for release.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-06-09 14:05:19 -04:00
5d345b79ee
various: Module version bump.
...
Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-04-27 10:51:06 -04:00
4bca3dade2
devices: Change netcontrol devices to pmqos.
...
Devices with the netcontrol_device_t type are actually PM QoS devices.
Rename the type and add labeling for /dev/memory_bandwidth.
Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
2019-04-24 09:17:36 -04:00
445cbed7c7
Bump module versions for release.
2019-02-01 15:03:42 -05:00
b6396ffe19
various: Module version bump.
2019-01-29 18:59:50 -05:00
3d65c79750
yet another little patch
...
This should all be obvious.
2019-01-29 18:45:30 -05:00
a7f2394902
various: Module version bump.
2019-01-20 16:45:55 -05:00
54136fa311
more tiny stuff
...
I think the old timesync labelling wasn't working anyway due to -- for a
directory name.
A couple of patches for devicekit calling dmidecode (this is part of replacing
some kmem access that was discussed on this list and rejected as a misfeature
in Debian DMI related code ages ago).
The rest should be obvious.
2019-01-20 16:20:33 -05:00
d6b46686cd
many: Module version bumps for changes from Russell Coker.
2019-01-05 14:33:50 -05:00
678c9e0b7a
misc services patches
...
Lots of little patches to services.
2019-01-05 13:30:30 -05:00
65e8f758ca
Bump module versions for release.
2018-07-01 11:02:33 -04:00
3ab07a0e1e
Move all files out of the old contrib directory.
2018-06-23 10:38:58 -04:00
09248fa0db
Move modules to contrib submodule.
2011-09-09 10:10:03 -04:00
29af4c13e7
Bump module versions for release.
2010-05-24 15:32:01 -04:00
61738f11ec
Devicekit patch from Dan Walsh.
2010-05-03 09:01:46 -04:00
677c4c2fea
add devicekit module from dan.
2009-07-29 10:02:06 -04:00
Chris PeBenito
Topi Miettinen
Jason Zaman
Chris PeBenito
Russell Coker
Chris PeBenito