Virt patch from Dan Walsh.
This commit is contained in:
Chris PeBenito
parent
064d1b469e
commit
7630200e1b
@ -7,6 +7,10 @@ HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t
|
||||
/etc/libvirt/[^/]* -d gen_context(system_u:object_r:virt_etc_rw_t,s0)
|
||||
/etc/libvirt/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0)
|
||||
/etc/rc\.d/init\.d/libvirtd -- gen_context(system_u:object_r:virtd_initrc_exec_t,s0)
|
||||
/etc/xen -d gen_context(system_u:object_r:virt_etc_t,s0)
|
||||
/etc/xen/[^/]* -- gen_context(system_u:object_r:virt_etc_t,s0)
|
||||
/etc/xen/[^/]* -d gen_context(system_u:object_r:virt_etc_rw_t,s0)
|
||||
/etc/xen/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0)
|
||||
|
||||
/usr/sbin/libvirtd -- gen_context(system_u:object_r:virtd_exec_t,s0)
|
||||
|
||||
|
||||
@ -20,8 +20,12 @@ template(`virt_domain_template',`
|
||||
|
||||
type $1_t, virt_domain;
|
||||
domain_type($1_t)
|
||||
domain_user_exemption_target($1_t)
|
||||
role system_r types $1_t;
|
||||
|
||||
type $1_devpts_t;
|
||||
term_pty($1_devpts_t)
|
||||
|
||||
type $1_tmp_t;
|
||||
files_tmp_file($1_tmp_t)
|
||||
|
||||
@ -35,6 +39,9 @@ template(`virt_domain_template',`
|
||||
type $1_var_run_t;
|
||||
files_pid_file($1_var_run_t)
|
||||
|
||||
allow $1_t $1_devpts_t:chr_file { rw_chr_file_perms setattr };
|
||||
term_create_pty($1_t, $1_devpts_t)
|
||||
|
||||
manage_dirs_pattern($1_t, $1_image_t, $1_image_t)
|
||||
manage_files_pattern($1_t, $1_image_t, $1_image_t)
|
||||
read_lnk_files_pattern($1_t, $1_image_t, $1_image_t)
|
||||
@ -62,6 +69,9 @@ template(`virt_domain_template',`
|
||||
files_pid_filetrans($1_t, $1_var_run_t, { dir file })
|
||||
stream_connect_pattern($1_t, $1_var_run_t, $1_var_run_t, virtd_t)
|
||||
|
||||
optional_policy(`
|
||||
xserver_rw_shm($1_t)
|
||||
')
|
||||
')
|
||||
|
||||
########################################
|
||||
@ -293,6 +303,7 @@ interface(`virt_read_lib_files',`
|
||||
|
||||
files_search_var_lib($1)
|
||||
read_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
|
||||
read_lnk_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
@ -471,7 +482,7 @@ interface(`virt_manage_images',`
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## All of the rules required to administrate
|
||||
## an virt environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(virt, 1.3.1)
|
||||
policy_module(virt, 1.3.2)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -13,6 +13,13 @@ policy_module(virt, 1.3.1)
|
||||
## </desc>
|
||||
gen_tunable(virt_use_comm, false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Allow virt to read fuse files
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(virt_use_fusefs, false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Allow virt to manage nfs files
|
||||
@ -84,11 +91,11 @@ type virtd_initrc_exec_t;
|
||||
init_script_file(virtd_initrc_exec_t)
|
||||
|
||||
ifdef(`enable_mcs',`
|
||||
init_ranged_daemon_domain(virtd_t, virtd_exec_t,s0 - mcs_systemhigh)
|
||||
init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mcs_systemhigh)
|
||||
')
|
||||
|
||||
ifdef(`enable_mls',`
|
||||
init_ranged_daemon_domain(virtd_t, virtd_exec_t,s0 - mls_systemhigh)
|
||||
init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mls_systemhigh)
|
||||
')
|
||||
|
||||
########################################
|
||||
@ -107,6 +114,7 @@ read_lnk_files_pattern(svirt_t, virt_image_t, virt_image_t)
|
||||
allow svirt_t svirt_image_t:dir search_dir_perms;
|
||||
manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t)
|
||||
manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
|
||||
fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file)
|
||||
|
||||
list_dirs_pattern(svirt_t, virt_content_t, virt_content_t)
|
||||
read_files_pattern(svirt_t, virt_content_t, virt_content_t)
|
||||
@ -118,10 +126,13 @@ corenet_udp_sendrecv_generic_node(svirt_t)
|
||||
corenet_udp_sendrecv_all_ports(svirt_t)
|
||||
corenet_udp_bind_generic_node(svirt_t)
|
||||
corenet_udp_bind_all_ports(svirt_t)
|
||||
corenet_tcp_bind_all_ports(svirt_t)
|
||||
corenet_tcp_connect_all_ports(svirt_t)
|
||||
|
||||
dev_list_sysfs(svirt_t)
|
||||
|
||||
userdom_search_user_home_content(svirt_t)
|
||||
userdom_read_user_home_content_symlinks(svirt_t)
|
||||
userdom_read_all_users_state(svirt_t)
|
||||
|
||||
tunable_policy(`virt_use_comm',`
|
||||
@ -129,6 +140,11 @@ tunable_policy(`virt_use_comm',`
|
||||
dev_rw_printer(svirt_t)
|
||||
')
|
||||
|
||||
tunable_policy(`virt_use_fusefs',`
|
||||
fs_read_fusefs_files(svirt_t)
|
||||
fs_read_fusefs_symlinks(svirt_t)
|
||||
')
|
||||
|
||||
tunable_policy(`virt_use_nfs',`
|
||||
fs_manage_nfs_dirs(svirt_t)
|
||||
fs_manage_nfs_files(svirt_t)
|
||||
@ -153,6 +169,10 @@ optional_policy(`
|
||||
xen_rw_image_files(svirt_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xen_rw_image_files(svirt_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# virtd local policy
|
||||
@ -165,6 +185,7 @@ allow virtd_t self:fifo_file rw_fifo_file_perms;
|
||||
allow virtd_t self:unix_stream_socket create_stream_socket_perms;
|
||||
allow virtd_t self:tcp_socket create_stream_socket_perms;
|
||||
allow virtd_t self:tun_socket create_socket_perms;
|
||||
allow virtd_t self:netlink_kobject_uevent_socket create_socket_perms;
|
||||
|
||||
manage_dirs_pattern(virtd_t, svirt_cache_t, svirt_cache_t)
|
||||
manage_files_pattern(virtd_t, svirt_cache_t, svirt_cache_t)
|
||||
@ -226,6 +247,7 @@ dev_rw_sysfs(virtd_t)
|
||||
dev_read_rand(virtd_t)
|
||||
dev_rw_kvm(virtd_t)
|
||||
dev_getattr_all_chr_files(virtd_t)
|
||||
dev_rw_mtrr(virtd_t)
|
||||
|
||||
# Init script handling
|
||||
domain_use_interactive_fds(virtd_t)
|
||||
@ -243,6 +265,8 @@ fs_list_auto_mountpoints(virtd_t)
|
||||
fs_getattr_xattr_fs(virtd_t)
|
||||
fs_rw_anon_inodefs_files(virtd_t)
|
||||
fs_list_inotifyfs(virtd_t)
|
||||
fs_manage_cgroup_dirs(virtd_t)
|
||||
fs_rw_cgroup_files(virtd_t)
|
||||
|
||||
mcs_process_set_categories(virtd_t)
|
||||
|
||||
@ -259,8 +283,10 @@ auth_use_nsswitch(virtd_t)
|
||||
|
||||
miscfiles_read_localization(virtd_t)
|
||||
miscfiles_read_certs(virtd_t)
|
||||
miscfiles_read_hwdata(virtd_t)
|
||||
|
||||
modutils_read_module_deps(virtd_t)
|
||||
modutils_read_module_config(virtd_t)
|
||||
modutils_manage_module_config(virtd_t)
|
||||
|
||||
logging_send_syslog_msg(virtd_t)
|
||||
@ -332,7 +358,7 @@ optional_policy(`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
policykit_dbus_chat(virtd_t)
|
||||
policykit_dbus_chat(virtd_t)
|
||||
policykit_domtrans_auth(virtd_t)
|
||||
policykit_domtrans_resolve(virtd_t)
|
||||
policykit_read_lib(virtd_t)
|
||||
@ -343,6 +369,7 @@ optional_policy(`
|
||||
qemu_read_state(virtd_t)
|
||||
qemu_signal(virtd_t)
|
||||
qemu_kill(virtd_t)
|
||||
qemu_setsched(virtd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -360,6 +387,7 @@ optional_policy(`
|
||||
|
||||
optional_policy(`
|
||||
udev_domtrans(virtd_t)
|
||||
udev_read_db(virtd_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@ -371,8 +399,8 @@ optional_policy(`
|
||||
# virtual domains common policy
|
||||
#
|
||||
|
||||
allow virt_domain self:capability { dac_read_search dac_override };
|
||||
allow virt_domain self:process { execmem signal getsched signull };
|
||||
allow virt_domain self:capability { dac_read_search dac_override kill };
|
||||
allow virt_domain self:process { execmem execstack signal getsched signull };
|
||||
allow virt_domain self:fifo_file rw_file_perms;
|
||||
allow virt_domain self:shm create_shm_perms;
|
||||
allow virt_domain self:unix_stream_socket create_stream_socket_perms;
|
||||
@ -399,7 +427,9 @@ corenet_rw_tun_tap_dev(virt_domain)
|
||||
corenet_tcp_bind_virt_migration_port(virt_domain)
|
||||
corenet_tcp_connect_virt_migration_port(virt_domain)
|
||||
|
||||
dev_read_rand(virt_domain)
|
||||
dev_read_sound(virt_domain)
|
||||
dev_read_urand(virt_domain)
|
||||
dev_write_sound(virt_domain)
|
||||
dev_rw_ksm(virt_domain)
|
||||
dev_rw_kvm(virt_domain)
|
||||
@ -410,11 +440,17 @@ domain_use_interactive_fds(virt_domain)
|
||||
files_read_etc_files(virt_domain)
|
||||
files_read_usr_files(virt_domain)
|
||||
files_read_var_files(virt_domain)
|
||||
files_search_all(virt_domain)
|
||||
|
||||
fs_getattr_tmpfs(virt_domain)
|
||||
fs_rw_anon_inodefs_files(virt_domain)
|
||||
fs_rw_tmpfs_files(virt_domain)
|
||||
|
||||
term_use_all_terms(virt_domain)
|
||||
term_getattr_pty_fs(virt_domain)
|
||||
term_use_generic_ptys(virt_domain)
|
||||
term_use_ptmx(virt_domain)
|
||||
|
||||
auth_use_nsswitch(virt_domain)
|
||||
|
||||
logging_send_syslog_msg(virt_domain)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user