diff --git a/policy/modules/services/virt.fc b/policy/modules/services/virt.fc index 1116f4fa4..2124b6add 100644 --- a/policy/modules/services/virt.fc +++ b/policy/modules/services/virt.fc @@ -7,6 +7,10 @@ HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t /etc/libvirt/[^/]* -d gen_context(system_u:object_r:virt_etc_rw_t,s0) /etc/libvirt/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0) /etc/rc\.d/init\.d/libvirtd -- gen_context(system_u:object_r:virtd_initrc_exec_t,s0) +/etc/xen -d gen_context(system_u:object_r:virt_etc_t,s0) +/etc/xen/[^/]* -- gen_context(system_u:object_r:virt_etc_t,s0) +/etc/xen/[^/]* -d gen_context(system_u:object_r:virt_etc_rw_t,s0) +/etc/xen/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0) /usr/sbin/libvirtd -- gen_context(system_u:object_r:virtd_exec_t,s0) diff --git a/policy/modules/services/virt.if b/policy/modules/services/virt.if index 92b6ca4fb..7bb17f6d3 100644 --- a/policy/modules/services/virt.if +++ b/policy/modules/services/virt.if @@ -20,8 +20,12 @@ template(`virt_domain_template',` type $1_t, virt_domain; domain_type($1_t) + domain_user_exemption_target($1_t) role system_r types $1_t; + type $1_devpts_t; + term_pty($1_devpts_t) + type $1_tmp_t; files_tmp_file($1_tmp_t) @@ -35,6 +39,9 @@ template(`virt_domain_template',` type $1_var_run_t; files_pid_file($1_var_run_t) + allow $1_t $1_devpts_t:chr_file { rw_chr_file_perms setattr }; + term_create_pty($1_t, $1_devpts_t) + manage_dirs_pattern($1_t, $1_image_t, $1_image_t) manage_files_pattern($1_t, $1_image_t, $1_image_t) read_lnk_files_pattern($1_t, $1_image_t, $1_image_t) @@ -62,6 +69,9 @@ template(`virt_domain_template',` files_pid_filetrans($1_t, $1_var_run_t, { dir file }) stream_connect_pattern($1_t, $1_var_run_t, $1_var_run_t, virtd_t) + optional_policy(` + xserver_rw_shm($1_t) + ') ') ######################################## @@ -293,6 +303,7 @@ interface(`virt_read_lib_files',` files_search_var_lib($1) read_files_pattern($1, virt_var_lib_t, virt_var_lib_t) + read_lnk_files_pattern($1, virt_var_lib_t, virt_var_lib_t) ') ######################################## @@ -471,7 +482,7 @@ interface(`virt_manage_images',` ######################################## ## -## All of the rules required to administrate +## All of the rules required to administrate ## an virt environment ## ## diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te index b02d62caa..a2989cd1a 100644 --- a/policy/modules/services/virt.te +++ b/policy/modules/services/virt.te @@ -1,5 +1,5 @@ -policy_module(virt, 1.3.1) +policy_module(virt, 1.3.2) ######################################## # @@ -13,6 +13,13 @@ policy_module(virt, 1.3.1) ## gen_tunable(virt_use_comm, false) +## +##

+## Allow virt to read fuse files +##

+## +gen_tunable(virt_use_fusefs, false) + ## ##

## Allow virt to manage nfs files @@ -84,11 +91,11 @@ type virtd_initrc_exec_t; init_script_file(virtd_initrc_exec_t) ifdef(`enable_mcs',` - init_ranged_daemon_domain(virtd_t, virtd_exec_t,s0 - mcs_systemhigh) + init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mcs_systemhigh) ') ifdef(`enable_mls',` - init_ranged_daemon_domain(virtd_t, virtd_exec_t,s0 - mls_systemhigh) + init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mls_systemhigh) ') ######################################## @@ -107,6 +114,7 @@ read_lnk_files_pattern(svirt_t, virt_image_t, virt_image_t) allow svirt_t svirt_image_t:dir search_dir_perms; manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t) manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t) +fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file) list_dirs_pattern(svirt_t, virt_content_t, virt_content_t) read_files_pattern(svirt_t, virt_content_t, virt_content_t) @@ -118,10 +126,13 @@ corenet_udp_sendrecv_generic_node(svirt_t) corenet_udp_sendrecv_all_ports(svirt_t) corenet_udp_bind_generic_node(svirt_t) corenet_udp_bind_all_ports(svirt_t) +corenet_tcp_bind_all_ports(svirt_t) +corenet_tcp_connect_all_ports(svirt_t) dev_list_sysfs(svirt_t) userdom_search_user_home_content(svirt_t) +userdom_read_user_home_content_symlinks(svirt_t) userdom_read_all_users_state(svirt_t) tunable_policy(`virt_use_comm',` @@ -129,6 +140,11 @@ tunable_policy(`virt_use_comm',` dev_rw_printer(svirt_t) ') +tunable_policy(`virt_use_fusefs',` + fs_read_fusefs_files(svirt_t) + fs_read_fusefs_symlinks(svirt_t) +') + tunable_policy(`virt_use_nfs',` fs_manage_nfs_dirs(svirt_t) fs_manage_nfs_files(svirt_t) @@ -153,6 +169,10 @@ optional_policy(` xen_rw_image_files(svirt_t) ') +optional_policy(` + xen_rw_image_files(svirt_t) +') + ######################################## # # virtd local policy @@ -165,6 +185,7 @@ allow virtd_t self:fifo_file rw_fifo_file_perms; allow virtd_t self:unix_stream_socket create_stream_socket_perms; allow virtd_t self:tcp_socket create_stream_socket_perms; allow virtd_t self:tun_socket create_socket_perms; +allow virtd_t self:netlink_kobject_uevent_socket create_socket_perms; manage_dirs_pattern(virtd_t, svirt_cache_t, svirt_cache_t) manage_files_pattern(virtd_t, svirt_cache_t, svirt_cache_t) @@ -226,6 +247,7 @@ dev_rw_sysfs(virtd_t) dev_read_rand(virtd_t) dev_rw_kvm(virtd_t) dev_getattr_all_chr_files(virtd_t) +dev_rw_mtrr(virtd_t) # Init script handling domain_use_interactive_fds(virtd_t) @@ -243,6 +265,8 @@ fs_list_auto_mountpoints(virtd_t) fs_getattr_xattr_fs(virtd_t) fs_rw_anon_inodefs_files(virtd_t) fs_list_inotifyfs(virtd_t) +fs_manage_cgroup_dirs(virtd_t) +fs_rw_cgroup_files(virtd_t) mcs_process_set_categories(virtd_t) @@ -259,8 +283,10 @@ auth_use_nsswitch(virtd_t) miscfiles_read_localization(virtd_t) miscfiles_read_certs(virtd_t) +miscfiles_read_hwdata(virtd_t) modutils_read_module_deps(virtd_t) +modutils_read_module_config(virtd_t) modutils_manage_module_config(virtd_t) logging_send_syslog_msg(virtd_t) @@ -332,7 +358,7 @@ optional_policy(` ') optional_policy(` - policykit_dbus_chat(virtd_t) + policykit_dbus_chat(virtd_t) policykit_domtrans_auth(virtd_t) policykit_domtrans_resolve(virtd_t) policykit_read_lib(virtd_t) @@ -343,6 +369,7 @@ optional_policy(` qemu_read_state(virtd_t) qemu_signal(virtd_t) qemu_kill(virtd_t) + qemu_setsched(virtd_t) ') optional_policy(` @@ -360,6 +387,7 @@ optional_policy(` optional_policy(` udev_domtrans(virtd_t) + udev_read_db(virtd_t) ') optional_policy(` @@ -371,8 +399,8 @@ optional_policy(` # virtual domains common policy # -allow virt_domain self:capability { dac_read_search dac_override }; -allow virt_domain self:process { execmem signal getsched signull }; +allow virt_domain self:capability { dac_read_search dac_override kill }; +allow virt_domain self:process { execmem execstack signal getsched signull }; allow virt_domain self:fifo_file rw_file_perms; allow virt_domain self:shm create_shm_perms; allow virt_domain self:unix_stream_socket create_stream_socket_perms; @@ -399,7 +427,9 @@ corenet_rw_tun_tap_dev(virt_domain) corenet_tcp_bind_virt_migration_port(virt_domain) corenet_tcp_connect_virt_migration_port(virt_domain) +dev_read_rand(virt_domain) dev_read_sound(virt_domain) +dev_read_urand(virt_domain) dev_write_sound(virt_domain) dev_rw_ksm(virt_domain) dev_rw_kvm(virt_domain) @@ -410,11 +440,17 @@ domain_use_interactive_fds(virt_domain) files_read_etc_files(virt_domain) files_read_usr_files(virt_domain) files_read_var_files(virt_domain) +files_search_all(virt_domain) fs_getattr_tmpfs(virt_domain) fs_rw_anon_inodefs_files(virt_domain) fs_rw_tmpfs_files(virt_domain) +term_use_all_terms(virt_domain) +term_getattr_pty_fs(virt_domain) +term_use_generic_ptys(virt_domain) +term_use_ptmx(virt_domain) + auth_use_nsswitch(virt_domain) logging_send_syslog_msg(virt_domain)