nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add label and interfaces for kernel PSI files

Browse Source 
The pressure stall information (PSI) special files in /proc/pressure
currently don't have a separate file context, and so default to proc_t.
Since users need read/write permissions to those files to use PSI, and
handing out blanket permissions to proc_t is strongly discouraged,
introduce a new proc_psi_t label, as well as interfaces for it.

Signed-off-by: Florian Schmidt <flosch@nutanix.com>
This commit is contained in:
Florian Schmidt 2023-06-29 12:58:49 +00:00
parent 429b26878b
commit cf09279eab
2 changed files with 48 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
policy/modules/kernel/kernel.if
View File

@ -1535,6 +1535,51 @@ interface(`kernel_read_network_state_symlinks',`
list_dirs_pattern($1, proc_t, proc_net_t)
')
########################################
## <summary>
## Allow caller to receive pressure stall information (PSI).
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`kernel_read_psi',`
gen_require(`
type proc_t, proc_psi_t;
')
read_files_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
read_lnk_files_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
list_dirs_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
')
########################################
## <summary>
## Allow caller to set up pressure stall information (PSI).
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`kernel_rw_psi',`
gen_require(`
type proc_t, proc_psi_t;
')
rw_files_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
read_lnk_files_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
list_dirs_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
# kernel requires writers to have CAP_SYS_RESOURCE
allow $1 self:capability sys_resource;
')
########################################
## <summary>
## Allow searching of xen state directory.

3
policy/modules/kernel/kernel.te
View File

@ -109,6 +109,9 @@ genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
type proc_net_t, proc_type;
genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0)
type proc_psi_t, proc_type;
genfscon proc /pressure gen_context(system_u:object_r:proc_psi_t,s0)
type proc_xen_t, proc_type;
files_mountpoint(proc_xen_t)
genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)