xen: Drop xend/xm stack.
Xend/xm was replaced with xl in Xen 4.5 (Jan 2015). https://xenproject.org/2015/01/15/less-is-more-in-the-new-xen-project-4-5-release/ Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
This commit is contained in:
Chris PeBenito
parent
2577feb839
commit
349411d555
|
|
@ -43,5 +43,4 @@ miscfiles_read_localization(brctl_t)
|
|||
|
||||
optional_policy(`
|
||||
xen_append_log(brctl_t)
|
||||
xen_dontaudit_rw_unix_stream_sockets(brctl_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -109,6 +109,4 @@ optional_policy(`
|
|||
kernel_read_xen_state(consoletype_t)
|
||||
kernel_write_xen_state(consoletype_t)
|
||||
xen_append_log(consoletype_t)
|
||||
xen_dontaudit_rw_unix_stream_sockets(consoletype_t)
|
||||
xen_dontaudit_use_fds(consoletype_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -106,7 +106,6 @@ optional_policy(`
|
|||
')
|
||||
|
||||
optional_policy(`
|
||||
xen_stream_connect(sblim_gatherd_t)
|
||||
xen_stream_connect_xenstore(sblim_gatherd_t)
|
||||
')
|
||||
|
||||
|
|
|
|||
|
|
@ -132,6 +132,5 @@ optional_policy(`
|
|||
')
|
||||
|
||||
optional_policy(`
|
||||
xen_dontaudit_rw_unix_stream_sockets(nscd_t)
|
||||
xen_append_log(nscd_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -184,6 +184,5 @@ optional_policy(`
|
|||
')
|
||||
|
||||
optional_policy(`
|
||||
xen_stream_connect(pegasus_t)
|
||||
xen_stream_connect_xenstore(pegasus_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -167,6 +167,5 @@ optional_policy(`
|
|||
kernel_read_xen_state(snmpd_t)
|
||||
kernel_write_xen_state(snmpd_t)
|
||||
|
||||
xen_stream_connect(snmpd_t)
|
||||
xen_stream_connect_xenstore(snmpd_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -79,7 +79,6 @@ optional_policy(`
|
|||
|
||||
optional_policy(`
|
||||
xen_domtrans_xm(vhostmd_t)
|
||||
xen_stream_connect(vhostmd_t)
|
||||
xen_stream_connect_xenstore(vhostmd_t)
|
||||
xen_stream_connect_xm(vhostmd_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -816,8 +816,8 @@ optional_policy(`
|
|||
kernel_read_xen_state(virtd_t)
|
||||
kernel_write_xen_state(virtd_t)
|
||||
|
||||
xen_exec(virtd_t)
|
||||
xen_stream_connect(virtd_t)
|
||||
xen_domtrans_xm(virtd_t)
|
||||
xen_stream_connect_xm(virtd_t)
|
||||
xen_stream_connect_xenstore(virtd_t)
|
||||
xen_read_image_files(virtd_t)
|
||||
')
|
||||
|
|
@ -940,9 +940,9 @@ optional_policy(`
|
|||
optional_policy(`
|
||||
xen_manage_image_dirs(virsh_t)
|
||||
xen_append_log(virsh_t)
|
||||
xen_domtrans(virsh_t)
|
||||
xen_domtrans_xm(virsh_t)
|
||||
xen_read_xenstored_runtime_files(virsh_t)
|
||||
xen_stream_connect(virsh_t)
|
||||
xen_stream_connect_xm(virsh_t)
|
||||
xen_stream_connect_xenstore(virsh_t)
|
||||
')
|
||||
|
||||
|
|
|
|||
|
|
@ -64,7 +64,6 @@ optional_policy(`
|
|||
|
||||
optional_policy(`
|
||||
xen_append_log(hostname_t)
|
||||
xen_dontaudit_use_fds(hostname_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
|
|
|
|||
|
|
@ -280,5 +280,4 @@ optional_policy(`
|
|||
|
||||
optional_policy(`
|
||||
xen_append_log(lvm_t)
|
||||
xen_dontaudit_rw_unix_stream_sockets(lvm_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -278,7 +278,6 @@ optional_policy(`
|
|||
kernel_read_xen_state(dhcpc_t)
|
||||
kernel_write_xen_state(dhcpc_t)
|
||||
xen_append_log(dhcpc_t)
|
||||
xen_dontaudit_rw_unix_stream_sockets(dhcpc_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
|
|
@ -419,5 +418,4 @@ optional_policy(`
|
|||
kernel_read_xen_state(ifconfig_t)
|
||||
kernel_write_xen_state(ifconfig_t)
|
||||
xen_append_log(ifconfig_t)
|
||||
xen_dontaudit_rw_unix_stream_sockets(ifconfig_t)
|
||||
')
|
||||
|
|
|
|||
|
|
@ -1,50 +1,39 @@
|
|||
/dev/xen/tapctrl.* -p gen_context(system_u:object_r:xenctl_t,s0)
|
||||
|
||||
/usr/lib/xen-[^/]*/bin/xenconsoled -- gen_context(system_u:object_r:xenconsoled_exec_t,s0)
|
||||
/usr/lib/xen-[^/]*/bin/xend -- gen_context(system_u:object_r:xend_exec_t,s0)
|
||||
/usr/lib/xen-[^/]*/bin/xenstored -- gen_context(system_u:object_r:xenstored_exec_t,s0)
|
||||
/usr/lib/xen-[^/]*/bin/xl -- gen_context(system_u:object_r:xm_exec_t,s0)
|
||||
/usr/lib/xen-[^/]*/bin/xm -- gen_context(system_u:object_r:xm_exec_t,s0)
|
||||
/usr/lib/xen-[^/]*/xl -- gen_context(system_u:object_r:xm_exec_t,s0)
|
||||
|
||||
/usr/bin/blktapctrl -- gen_context(system_u:object_r:blktap_exec_t,s0)
|
||||
/usr/bin/evtchnd -- gen_context(system_u:object_r:evtchnd_exec_t,s0)
|
||||
/usr/bin/tapdisk -- gen_context(system_u:object_r:blktap_exec_t,s0)
|
||||
/usr/bin/xenconsoled -- gen_context(system_u:object_r:xenconsoled_exec_t,s0)
|
||||
/usr/bin/xend -- gen_context(system_u:object_r:xend_exec_t,s0)
|
||||
/usr/bin/xenstored -- gen_context(system_u:object_r:xenstored_exec_t,s0)
|
||||
/usr/bin/xl -- gen_context(system_u:object_r:xm_exec_t,s0)
|
||||
/usr/bin/xm -- gen_context(system_u:object_r:xm_exec_t,s0)
|
||||
|
||||
/usr/sbin/blktapctrl -- gen_context(system_u:object_r:blktap_exec_t,s0)
|
||||
/usr/sbin/evtchnd -- gen_context(system_u:object_r:evtchnd_exec_t,s0)
|
||||
/usr/sbin/tapdisk -- gen_context(system_u:object_r:blktap_exec_t,s0)
|
||||
/usr/sbin/xenconsoled -- gen_context(system_u:object_r:xenconsoled_exec_t,s0)
|
||||
/usr/sbin/xend -- gen_context(system_u:object_r:xend_exec_t,s0)
|
||||
/usr/sbin/xenstored -- gen_context(system_u:object_r:xenstored_exec_t,s0)
|
||||
/usr/sbin/xl -- gen_context(system_u:object_r:xm_exec_t,s0)
|
||||
/usr/sbin/xm -- gen_context(system_u:object_r:xm_exec_t,s0)
|
||||
|
||||
/var/lib/xen(/.*)? gen_context(system_u:object_r:xend_var_lib_t,s0)
|
||||
/var/lib/xen(/.*)? gen_context(system_u:object_r:xen_state_t,s0)
|
||||
/var/lib/xen/images(/.*)? gen_context(system_u:object_r:xen_image_t,s0)
|
||||
/var/lib/xend(/.*)? gen_context(system_u:object_r:xend_var_lib_t,s0)
|
||||
/var/lib/xenstored(/.*)? gen_context(system_u:object_r:xenstored_var_lib_t,s0)
|
||||
|
||||
/var/lock/xl -- gen_context(system_u:object_r:xen_lock_t,s0)
|
||||
|
||||
/var/log/evtchnd\.log.* -- gen_context(system_u:object_r:evtchnd_var_log_t,s0)
|
||||
/var/log/xen(/.*)? gen_context(system_u:object_r:xend_var_log_t,s0)
|
||||
/var/log/xen-hotplug\.log.* -- gen_context(system_u:object_r:xend_var_log_t,s0)
|
||||
/var/log/xend\.log.* -- gen_context(system_u:object_r:xend_var_log_t,s0)
|
||||
/var/log/xend-debug\.log.* -- gen_context(system_u:object_r:xend_var_log_t,s0)
|
||||
/var/log/xen(/.*)? gen_context(system_u:object_r:xen_log_t,s0)
|
||||
/var/log/xen-hotplug\.log.* -- gen_context(system_u:object_r:xen_log_t,s0)
|
||||
|
||||
/run/evtchnd -s gen_context(system_u:object_r:evtchnd_runtime_t,s0)
|
||||
/run/evtchnd\.pid -- gen_context(system_u:object_r:evtchnd_runtime_t,s0)
|
||||
/run/xenconsoled\.pid -- gen_context(system_u:object_r:xenconsoled_runtime_t,s0)
|
||||
/run/xend(/.*)? gen_context(system_u:object_r:xend_runtime_t,s0)
|
||||
/run/xen -d gen_context(system_u:object_r:xend_runtime_t,s0)
|
||||
/run/xend\.pid -- gen_context(system_u:object_r:xend_runtime_t,s0)
|
||||
/run/xenner(/.*)? gen_context(system_u:object_r:xend_runtime_t,s0)
|
||||
/run/xen -d gen_context(system_u:object_r:xen_runtime_t,s0)
|
||||
/run/xenner(/.*)? gen_context(system_u:object_r:xen_runtime_t,s0)
|
||||
/run/xenstore\.pid -- gen_context(system_u:object_r:xenstored_runtime_t,s0)
|
||||
/run/xenstored(/.*)? gen_context(system_u:object_r:xenstored_runtime_t,s0)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,80 +1,5 @@
|
|||
## <summary>Xen hypervisor.</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run xend.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`xen_domtrans',`
|
||||
gen_require(`
|
||||
type xend_t, xend_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, xend_exec_t, xend_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute xend in the caller domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`xen_exec',`
|
||||
gen_require(`
|
||||
type xend_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
can_exec($1, xend_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Inherit and use xen file descriptors.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`xen_use_fds',`
|
||||
gen_require(`
|
||||
type xend_t;
|
||||
')
|
||||
|
||||
allow $1 xend_t:fd use;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to inherit
|
||||
## xen file descriptors.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain to not audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`xen_dontaudit_use_fds',`
|
||||
gen_require(`
|
||||
type xend_t;
|
||||
')
|
||||
|
||||
dontaudit $1 xend_t:fd use;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create, read, write, and delete
|
||||
|
|
@ -88,11 +13,11 @@ interface(`xen_dontaudit_use_fds',`
|
|||
#
|
||||
interface(`xen_manage_image_dirs',`
|
||||
gen_require(`
|
||||
type xend_var_lib_t;
|
||||
type xen_state_t;
|
||||
')
|
||||
|
||||
files_search_var_lib($1)
|
||||
manage_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t)
|
||||
manage_dirs_pattern($1, xen_state_t, xen_state_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
|
|
@ -107,12 +32,12 @@ interface(`xen_manage_image_dirs',`
|
|||
#
|
||||
interface(`xen_read_image_files',`
|
||||
gen_require(`
|
||||
type xen_image_t, xend_var_lib_t;
|
||||
type xen_image_t, xen_state_t;
|
||||
')
|
||||
|
||||
files_list_var_lib($1)
|
||||
list_dirs_pattern($1, xend_var_lib_t, xend_var_lib_t)
|
||||
read_files_pattern($1, { xend_var_lib_t xen_image_t }, xen_image_t)
|
||||
list_dirs_pattern($1, xen_state_t, xen_state_t)
|
||||
read_files_pattern($1, { xen_state_t xen_image_t }, xen_image_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
|
|
@ -127,11 +52,11 @@ interface(`xen_read_image_files',`
|
|||
#
|
||||
interface(`xen_rw_image_files',`
|
||||
gen_require(`
|
||||
type xen_image_t, xend_var_lib_t;
|
||||
type xen_image_t, xen_state_t;
|
||||
')
|
||||
|
||||
files_list_var_lib($1)
|
||||
allow $1 xend_var_lib_t:dir search_dir_perms;
|
||||
allow $1 xen_state_t:dir search_dir_perms;
|
||||
rw_files_pattern($1, xen_image_t, xen_image_t)
|
||||
')
|
||||
|
||||
|
|
@ -147,12 +72,12 @@ interface(`xen_rw_image_files',`
|
|||
#
|
||||
interface(`xen_append_log',`
|
||||
gen_require(`
|
||||
type xend_var_log_t;
|
||||
type xen_log_t;
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
append_files_pattern($1, xend_var_log_t, xend_var_log_t)
|
||||
dontaudit $1 xend_var_log_t:file write;
|
||||
append_files_pattern($1, xen_log_t, xen_log_t)
|
||||
dontaudit $1 xen_log_t:file write;
|
||||
')
|
||||
|
||||
########################################
|
||||
|
|
@ -168,12 +93,12 @@ interface(`xen_append_log',`
|
|||
#
|
||||
interface(`xen_manage_log',`
|
||||
gen_require(`
|
||||
type xend_var_log_t;
|
||||
type xen_log_t;
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
manage_dirs_pattern($1, xend_var_log_t, xend_var_log_t)
|
||||
manage_files_pattern($1, xend_var_log_t, xend_var_log_t)
|
||||
manage_dirs_pattern($1, xen_log_t, xen_log_t)
|
||||
manage_files_pattern($1, xen_log_t, xen_log_t)
|
||||
')
|
||||
|
||||
#######################################
|
||||
|
|
@ -195,25 +120,6 @@ interface(`xen_read_xenstored_runtime_files',`
|
|||
read_files_pattern($1, xenstored_runtime_t, xenstored_runtime_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to read and write
|
||||
## Xen unix domain stream sockets.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain to not audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`xen_dontaudit_rw_unix_stream_sockets',`
|
||||
gen_require(`
|
||||
type xend_t;
|
||||
')
|
||||
|
||||
dontaudit $1 xend_t:unix_stream_socket { read write };
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Connect to xenstored with a unix
|
||||
|
|
@ -236,30 +142,7 @@ interface(`xen_stream_connect_xenstore',`
|
|||
|
||||
########################################
|
||||
## <summary>
|
||||
## Connect to xend with a unix
|
||||
## domain stream socket.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`xen_stream_connect',`
|
||||
gen_require(`
|
||||
type xend_t, xend_runtime_t, xend_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_runtime($1)
|
||||
stream_connect_pattern($1, xend_runtime_t, xend_runtime_t, xend_t)
|
||||
|
||||
files_search_var_lib($1)
|
||||
stream_connect_pattern($1, xend_var_lib_t, xend_var_lib_t, xend_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create in a xend_runtime_t directory
|
||||
## Create in a xen_runtime_t directory
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
|
|
@ -279,10 +162,10 @@ interface(`xen_stream_connect',`
|
|||
#
|
||||
interface(`xen_runtime_filetrans',`
|
||||
gen_require(`
|
||||
type xend_runtime_t;
|
||||
type xen_runtime_t;
|
||||
')
|
||||
|
||||
filetrans_pattern($1, xend_runtime_t, $2, $3)
|
||||
filetrans_pattern($1, xen_runtime_t, $2, $3)
|
||||
')
|
||||
|
||||
########################################
|
||||
|
|
|
|||
|
|
@ -5,14 +5,6 @@ policy_module(xen)
|
|||
# Declarations
|
||||
#
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Determine whether xend can
|
||||
## run blktapctrl and tapdisk.
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(xend_run_blktap, false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Determine whether xen can
|
||||
|
|
@ -68,29 +60,25 @@ optional_policy(`
|
|||
virt_image(xen_image_t)
|
||||
')
|
||||
|
||||
type xenctl_t;
|
||||
files_type(xenctl_t)
|
||||
|
||||
type xend_t;
|
||||
type xend_exec_t;
|
||||
init_daemon_domain(xend_t, xend_exec_t)
|
||||
|
||||
type xen_lock_t;
|
||||
files_lock_file(xen_lock_t)
|
||||
|
||||
type xend_runtime_t alias xend_var_run_t;
|
||||
files_runtime_file(xend_runtime_t)
|
||||
files_mountpoint(xend_runtime_t)
|
||||
type xen_log_t;
|
||||
typealias xen_log_t alias xend_var_log_t;
|
||||
logging_log_file(xen_log_t)
|
||||
|
||||
type xend_tmp_t;
|
||||
files_tmp_file(xend_tmp_t)
|
||||
type xen_runtime_t;
|
||||
typealias xen_runtime_t alias xend_runtime_t;
|
||||
files_runtime_file(xen_runtime_t)
|
||||
files_mountpoint(xen_runtime_t)
|
||||
|
||||
type xend_var_lib_t;
|
||||
files_type(xend_var_lib_t)
|
||||
files_mountpoint(xend_var_lib_t)
|
||||
type xen_state_t;
|
||||
typealias xen_state_t alias xend_var_lib_t;
|
||||
files_type(xen_state_t)
|
||||
files_mountpoint(xen_state_t)
|
||||
|
||||
type xend_var_log_t;
|
||||
logging_log_file(xend_var_log_t)
|
||||
type xenctl_t;
|
||||
files_type(xenctl_t)
|
||||
|
||||
type xenstored_t;
|
||||
type xenstored_exec_t;
|
||||
|
|
@ -126,24 +114,18 @@ init_system_domain(xm_t, xm_exec_t)
|
|||
# blktap local policy
|
||||
#
|
||||
|
||||
tunable_policy(`xend_run_blktap',`
|
||||
domtrans_pattern(xend_t, blktap_exec_t, blktap_t)
|
||||
allow blktap_t self:fifo_file rw_inherited_fifo_file_perms;
|
||||
|
||||
allow blktap_t self:fifo_file rw_inherited_fifo_file_perms;
|
||||
dev_read_sysfs(blktap_t)
|
||||
dev_rw_xen(blktap_t)
|
||||
|
||||
dev_read_sysfs(blktap_t)
|
||||
dev_rw_xen(blktap_t)
|
||||
files_read_etc_files(blktap_t)
|
||||
|
||||
files_read_etc_files(blktap_t)
|
||||
logging_send_syslog_msg(blktap_t)
|
||||
|
||||
logging_send_syslog_msg(blktap_t)
|
||||
miscfiles_read_localization(blktap_t)
|
||||
|
||||
miscfiles_read_localization(blktap_t)
|
||||
|
||||
xen_stream_connect_xenstore(blktap_t)
|
||||
',`
|
||||
dontaudit xend_t blktap_exec_t:file { execute execute_no_trans };
|
||||
')
|
||||
xen_stream_connect_xenstore(blktap_t)
|
||||
|
||||
#######################################
|
||||
#
|
||||
|
|
@ -161,200 +143,6 @@ manage_files_pattern(evtchnd_t, evtchnd_runtime_t, evtchnd_runtime_t)
|
|||
manage_sock_files_pattern(evtchnd_t, evtchnd_runtime_t, evtchnd_runtime_t)
|
||||
files_runtime_filetrans(evtchnd_t, evtchnd_runtime_t, { file sock_file dir })
|
||||
|
||||
########################################
|
||||
#
|
||||
# xend local policy
|
||||
#
|
||||
|
||||
allow xend_t self:capability { dac_override ipc_lock net_admin net_raw setuid sys_admin sys_nice sys_rawio sys_resource sys_tty_config };
|
||||
dontaudit xend_t self:capability { sys_ptrace };
|
||||
allow xend_t self:process { setrlimit signal sigkill };
|
||||
dontaudit xend_t self:process ptrace;
|
||||
allow xend_t self:fifo_file rw_fifo_file_perms;
|
||||
allow xend_t self:unix_stream_socket { accept listen };
|
||||
allow xend_t self:tcp_socket { accept listen };
|
||||
allow xend_t self:packet_socket create_socket_perms;
|
||||
allow xend_t self:tun_socket create_socket_perms;
|
||||
|
||||
allow xend_t xen_image_t:dir list_dir_perms;
|
||||
manage_dirs_pattern(xend_t, xen_image_t, xen_image_t)
|
||||
manage_fifo_files_pattern(xend_t, xen_image_t, xen_image_t)
|
||||
manage_files_pattern(xend_t, xen_image_t, xen_image_t)
|
||||
read_lnk_files_pattern(xend_t, xen_image_t, xen_image_t)
|
||||
read_sock_files_pattern(xend_t, xen_image_t, xen_image_t)
|
||||
rw_chr_files_pattern(xend_t, xen_image_t, xen_image_t)
|
||||
rw_blk_files_pattern(xend_t, xen_image_t, xen_image_t)
|
||||
fs_hugetlbfs_filetrans(xend_t, xen_image_t, file)
|
||||
|
||||
allow xend_t xenctl_t:fifo_file manage_fifo_file_perms;
|
||||
dev_filetrans(xend_t, xenctl_t, fifo_file)
|
||||
|
||||
manage_files_pattern(xend_t, xend_tmp_t, xend_tmp_t)
|
||||
manage_dirs_pattern(xend_t, xend_tmp_t, xend_tmp_t)
|
||||
files_tmp_filetrans(xend_t, xend_tmp_t, { file dir })
|
||||
|
||||
manage_dirs_pattern(xend_t, xend_runtime_t, xend_runtime_t)
|
||||
manage_files_pattern(xend_t, xend_runtime_t, xend_runtime_t)
|
||||
manage_sock_files_pattern(xend_t, xend_runtime_t, xend_runtime_t)
|
||||
manage_fifo_files_pattern(xend_t, xend_runtime_t, xend_runtime_t)
|
||||
files_runtime_filetrans(xend_t, xend_runtime_t, { file sock_file fifo_file dir })
|
||||
|
||||
manage_dirs_pattern(xend_t, xend_var_log_t, xend_var_log_t)
|
||||
append_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
|
||||
create_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
|
||||
setattr_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
|
||||
manage_sock_files_pattern(xend_t, xend_var_log_t, xend_var_log_t)
|
||||
logging_log_filetrans(xend_t, xend_var_log_t, { sock_file file dir })
|
||||
|
||||
manage_dirs_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
|
||||
manage_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
|
||||
manage_sock_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
|
||||
manage_fifo_files_pattern(xend_t, xend_var_lib_t, xend_var_lib_t)
|
||||
files_var_lib_filetrans(xend_t, xend_var_lib_t, { file dir })
|
||||
|
||||
manage_files_pattern(xend_t, xenstored_runtime_t, xenstored_runtime_t)
|
||||
|
||||
allow xend_t xenstored_var_lib_t:dir list_dir_perms;
|
||||
|
||||
domtrans_pattern(xend_t, xenconsoled_exec_t, xenconsoled_t)
|
||||
domtrans_pattern(xend_t, xenstored_exec_t, xenstored_t)
|
||||
|
||||
xen_stream_connect_xenstore(xend_t)
|
||||
|
||||
kernel_read_kernel_sysctls(xend_t)
|
||||
kernel_read_system_state(xend_t)
|
||||
kernel_write_xen_state(xend_t)
|
||||
kernel_read_xen_state(xend_t)
|
||||
kernel_rw_net_sysctls(xend_t)
|
||||
kernel_read_network_state(xend_t)
|
||||
kernel_read_vm_sysctls(xend_t)
|
||||
|
||||
corecmd_exec_bin(xend_t)
|
||||
corecmd_exec_shell(xend_t)
|
||||
|
||||
corenet_all_recvfrom_netlabel(xend_t)
|
||||
corenet_tcp_sendrecv_generic_if(xend_t)
|
||||
corenet_tcp_sendrecv_generic_node(xend_t)
|
||||
corenet_tcp_bind_generic_node(xend_t)
|
||||
|
||||
corenet_sendrecv_xen_server_packets(xend_t)
|
||||
corenet_tcp_bind_xen_port(xend_t)
|
||||
|
||||
corenet_sendrecv_soundd_server_packets(xend_t)
|
||||
corenet_tcp_bind_soundd_port(xend_t)
|
||||
|
||||
corenet_sendrecv_generic_server_packets(xend_t)
|
||||
corenet_tcp_bind_generic_port(xend_t)
|
||||
|
||||
corenet_sendrecv_vnc_server_packets(xend_t)
|
||||
corenet_tcp_bind_vnc_port(xend_t)
|
||||
|
||||
corenet_sendrecv_xserver_client_packets(xend_t)
|
||||
corenet_tcp_connect_xserver_port(xend_t)
|
||||
|
||||
corenet_sendrecv_xen_client_packets(xend_t)
|
||||
corenet_tcp_connect_xen_port(xend_t)
|
||||
|
||||
corenet_rw_tun_tap_dev(xend_t)
|
||||
|
||||
dev_getattr_all_chr_files(xend_t)
|
||||
dev_read_urand(xend_t)
|
||||
dev_filetrans_xen(xend_t)
|
||||
dev_rw_sysfs(xend_t)
|
||||
dev_rw_xen(xend_t)
|
||||
|
||||
domain_dontaudit_read_all_domains_state(xend_t)
|
||||
domain_dontaudit_ptrace_all_domains(xend_t)
|
||||
|
||||
files_read_etc_files(xend_t)
|
||||
files_read_kernel_symbol_table(xend_t)
|
||||
files_read_kernel_img(xend_t)
|
||||
files_manage_etc_runtime_files(xend_t)
|
||||
files_etc_filetrans_etc_runtime(xend_t, file)
|
||||
files_read_usr_files(xend_t)
|
||||
files_read_default_symlinks(xend_t)
|
||||
files_search_mnt(xend_t)
|
||||
|
||||
fs_getattr_all_fs(xend_t)
|
||||
fs_list_auto_mountpoints(xend_t)
|
||||
fs_read_dos_files(xend_t)
|
||||
fs_read_removable_blk_files(xend_t)
|
||||
fs_manage_xenfs_dirs(xend_t)
|
||||
fs_manage_xenfs_files(xend_t)
|
||||
|
||||
storage_read_scsi_generic(xend_t)
|
||||
# for lsscsi
|
||||
storage_getattr_fixed_disk_dev(xend_t)
|
||||
|
||||
term_setattr_generic_ptys(xend_t)
|
||||
term_getattr_all_ptys(xend_t)
|
||||
term_setattr_all_ptys(xend_t)
|
||||
term_use_generic_ptys(xend_t)
|
||||
term_use_ptmx(xend_t)
|
||||
term_getattr_pty_fs(xend_t)
|
||||
|
||||
init_stream_connect_script(xend_t)
|
||||
|
||||
locallogin_dontaudit_use_fds(xend_t)
|
||||
|
||||
logging_send_syslog_msg(xend_t)
|
||||
|
||||
miscfiles_read_localization(xend_t)
|
||||
miscfiles_read_hwdata(xend_t)
|
||||
|
||||
sysnet_domtrans_dhcpc(xend_t)
|
||||
sysnet_signal_dhcpc(xend_t)
|
||||
sysnet_domtrans_ifconfig(xend_t)
|
||||
sysnet_dns_name_resolve(xend_t)
|
||||
sysnet_delete_dhcpc_runtime_files(xend_t)
|
||||
sysnet_read_dhcpc_runtime_files(xend_t)
|
||||
sysnet_rw_dhcp_config(xend_t)
|
||||
|
||||
userdom_dontaudit_search_user_home_dirs(xend_t)
|
||||
|
||||
tunable_policy(`xen_use_fusefs',`
|
||||
fs_manage_fusefs_dirs(xend_t)
|
||||
fs_manage_fusefs_files(xend_t)
|
||||
fs_read_fusefs_symlinks(xend_t)
|
||||
')
|
||||
|
||||
tunable_policy(`xen_use_nfs',`
|
||||
fs_manage_nfs_dirs(xend_t)
|
||||
fs_manage_nfs_files(xend_t)
|
||||
fs_read_nfs_symlinks(xend_t)
|
||||
')
|
||||
|
||||
tunable_policy(`xen_use_samba',`
|
||||
fs_manage_cifs_dirs(xend_t)
|
||||
fs_manage_cifs_files(xend_t)
|
||||
fs_read_cifs_symlinks(xend_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
brctl_domtrans(xend_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
consoletype_exec(xend_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
lvm_domtrans(xend_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
mount_domtrans(xend_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
netutils_domtrans(xend_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
virt_search_images(xend_t)
|
||||
virt_read_config(xend_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# Xen console local policy
|
||||
|
|
@ -367,10 +155,10 @@ allow xenconsoled_t self:fifo_file rw_fifo_file_perms;
|
|||
|
||||
allow xenconsoled_t xen_devpts_t:chr_file { rw_term_perms setattr_chr_file_perms };
|
||||
|
||||
manage_dirs_pattern(xenconsoled_t, xend_var_log_t, xend_var_log_t)
|
||||
append_files_pattern(xenconsoled_t, xend_var_log_t, xend_var_log_t)
|
||||
create_files_pattern(xenconsoled_t, xend_var_log_t, xend_var_log_t)
|
||||
setattr_files_pattern(xenconsoled_t, xend_var_log_t, xend_var_log_t)
|
||||
manage_dirs_pattern(xenconsoled_t, xen_log_t, xen_log_t)
|
||||
append_files_pattern(xenconsoled_t, xen_log_t, xen_log_t)
|
||||
create_files_pattern(xenconsoled_t, xen_log_t, xen_log_t)
|
||||
setattr_files_pattern(xenconsoled_t, xen_log_t, xen_log_t)
|
||||
|
||||
manage_files_pattern(xenconsoled_t, xenconsoled_runtime_t, xenconsoled_runtime_t)
|
||||
manage_sock_files_pattern(xenconsoled_t, xenconsoled_runtime_t, xenconsoled_runtime_t)
|
||||
|
|
@ -475,16 +263,16 @@ allow xm_t self:fifo_file rw_fifo_file_perms;
|
|||
allow xm_t self:unix_stream_socket { accept connectto listen };
|
||||
allow xm_t self:tcp_socket { accept listen };
|
||||
|
||||
allow xm_t xend_runtime_t:dir rw_dir_perms;
|
||||
allow xm_t xen_runtime_t:dir rw_dir_perms;
|
||||
|
||||
allow xm_t xen_lock_t:file manage_file_perms;
|
||||
files_lock_filetrans(xm_t, xen_lock_t, file)
|
||||
|
||||
manage_files_pattern(xm_t, xend_var_log_t, xend_var_log_t)
|
||||
manage_files_pattern(xm_t, xen_log_t, xen_log_t)
|
||||
|
||||
manage_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
|
||||
manage_fifo_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
|
||||
manage_sock_files_pattern(xm_t, xend_var_lib_t, xend_var_lib_t)
|
||||
manage_files_pattern(xm_t, xen_state_t, xen_state_t)
|
||||
manage_fifo_files_pattern(xm_t, xen_state_t, xen_state_t)
|
||||
manage_sock_files_pattern(xm_t, xen_state_t, xen_state_t)
|
||||
|
||||
manage_files_pattern(xm_t, xen_image_t, xen_image_t)
|
||||
manage_blk_files_pattern(xm_t, xen_image_t, xen_image_t)
|
||||
|
|
@ -494,8 +282,6 @@ read_files_pattern(xm_t, xenstored_runtime_t, xenstored_runtime_t)
|
|||
|
||||
xen_manage_image_dirs(xm_t)
|
||||
xen_append_log(xm_t)
|
||||
xen_domtrans(xm_t)
|
||||
xen_stream_connect(xm_t)
|
||||
xen_stream_connect_xenstore(xm_t)
|
||||
|
||||
can_exec(xm_t, xm_exec_t)
|
||||
|
|
|
|||
Loading…
Reference in New Issue