nnd
/
selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Dontaudit access on security_t file system at /sys/fs/selinux 

Second part of the support of security_t under /sys/fs/selinux - when
asked not to audit getting attributes on the selinux file system, have
this propagate to the sysfs parts as well.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
This commit is contained in:
Sven Vermeulen 2014-04-11 20:01:42 +02:00 committed by Chris PeBenito
parent 4c68c98ed2
commit ddca151876
2 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
policy/modules/kernel/devices.if
View File

@ -3889,6 +3889,24 @@ interface(`dev_getattr_sysfs',`
allow $1 sysfs_t:filesystem getattr;
')
########################################
## <summary>
## Do not audit getting the attributes of sysfs filesystem
## </summary>
## <param name="domain">
## <summary>
## Domain to dontaudit access from
## </summary>
## </param>
#
interface(`dev_dontaudit_getattr_sysfs',`
gen_require(`
type sysfs_t;
')
dontaudit $1 sysfs_t:filesystem getattr;
')
########################################
## <summary>
## Search the sysfs directories.

6
policy/modules/kernel/selinux.if
View File

@ -93,6 +93,10 @@ interface(`selinux_dontaudit_get_fs_mount',`
# (/selinux) is already a selinuxfs
dontaudit $1 security_t:filesystem getattr;
# Same for /sys/fs/selinux
dev_dontaudit_getattr_sysfs($1)
dev_dontaudit_search_sysfs($1)
# read /proc/filesystems to see if selinuxfs is supported
# then read /proc/self/mount to see where selinuxfs is mounted
kernel_dontaudit_read_system_state($1)
@ -192,7 +196,7 @@ interface(`selinux_dontaudit_getattr_fs',`
dontaudit $1 security_t:filesystem getattr;
dev_dontaudit_getattr_sysfs_fs($1)
dev_dontaudit_getattr_sysfs($1)
dev_dontaudit_search_sysfs($1)
')