Add label and interfaces for kernel PSI files
The pressure stall information (PSI) special files in /proc/pressure currently don't have a separate file context, and so default to proc_t. Since users need read/write permissions to those files to use PSI, and handing out blanket permissions to proc_t is strongly discouraged, introduce a new proc_psi_t label, as well as interfaces for it. Signed-off-by: Florian Schmidt <flosch@nutanix.com>
This commit is contained in:
parent
429b26878b
commit
cf09279eab
@ -1535,6 +1535,51 @@ interface(`kernel_read_network_state_symlinks',`
|
||||
list_dirs_pattern($1, proc_t, proc_net_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow caller to receive pressure stall information (PSI).
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`kernel_read_psi',`
|
||||
gen_require(`
|
||||
type proc_t, proc_psi_t;
|
||||
')
|
||||
|
||||
read_files_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
|
||||
read_lnk_files_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
|
||||
list_dirs_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow caller to set up pressure stall information (PSI).
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`kernel_rw_psi',`
|
||||
gen_require(`
|
||||
type proc_t, proc_psi_t;
|
||||
')
|
||||
|
||||
rw_files_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
|
||||
read_lnk_files_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
|
||||
list_dirs_pattern($1, { proc_t proc_psi_t }, proc_psi_t)
|
||||
|
||||
# kernel requires writers to have CAP_SYS_RESOURCE
|
||||
allow $1 self:capability sys_resource;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow searching of xen state directory.
|
||||
|
@ -109,6 +109,9 @@ genfscon proc /mdstat gen_context(system_u:object_r:proc_mdstat_t,s0)
|
||||
type proc_net_t, proc_type;
|
||||
genfscon proc /net gen_context(system_u:object_r:proc_net_t,s0)
|
||||
|
||||
type proc_psi_t, proc_type;
|
||||
genfscon proc /pressure gen_context(system_u:object_r:proc_psi_t,s0)
|
||||
|
||||
type proc_xen_t, proc_type;
|
||||
files_mountpoint(proc_xen_t)
|
||||
genfscon proc /xen gen_context(system_u:object_r:proc_xen_t,s0)
|
||||
|
Loading…
Reference in New Issue
Block a user