fbbed63769
Needed by zfs-mount.service.
type=PROCTITLE msg=audit(1705092131.987:49): proctitle=2F7362696E2F7A6673007368617265002D61
type=SYSCALL msg=audit(1705092131.987:49): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=665f44189eba a2=80042 a3=180 items=0 ppid=1 pid=3082 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="zfs" exe="/usr/bin/zfs" subj=system_u:system_r:zfs_t:s0 key=(null)
type=AVC msg=audit(1705092131.987:49): avc: denied { write } for pid=3082 comm="zfs" name="zfs.exports.lock" dev="dm-0" ino=1296 scontext=system_u:system_r:zfs_t:s0 tcontext=system_u:object_r:exports_t:s0 tclass=file permissive=0
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
179 lines
4.0 KiB
Plaintext
179 lines
4.0 KiB
Plaintext
policy_module(zfs)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
attribute_role zfs_roles;
|
|
|
|
type zed_t;
|
|
type zed_exec_t;
|
|
init_daemon_domain(zed_t, zed_exec_t)
|
|
role zfs_roles types zed_t;
|
|
|
|
type zfs_t;
|
|
type zfs_exec_t;
|
|
init_system_domain(zfs_t, zfs_exec_t)
|
|
role zfs_roles types zfs_t;
|
|
|
|
type zfs_config_t;
|
|
files_config_file(zfs_config_t)
|
|
|
|
type zfs_zpool_cache_t;
|
|
files_config_file(zfs_zpool_cache_t)
|
|
|
|
type zfs_runtime_t;
|
|
files_runtime_file(zfs_runtime_t)
|
|
|
|
########################################
|
|
#
|
|
# zed local policy
|
|
#
|
|
|
|
allow zed_t self:process signal;
|
|
allow zed_t self:capability sys_admin;
|
|
dontaudit zed_t self:capability net_admin;
|
|
allow zed_t self:fifo_file rw_fifo_file_perms;
|
|
allow zed_t self:unix_dgram_socket create_socket_perms;
|
|
allow zed_t self:netlink_kobject_uevent_socket create_socket_perms;
|
|
|
|
domtrans_pattern(zed_t, zfs_exec_t, zfs_t)
|
|
|
|
list_dirs_pattern(zed_t, zfs_config_t, zfs_config_t)
|
|
read_files_pattern(zed_t, zfs_config_t, zfs_config_t)
|
|
read_lnk_files_pattern(zed_t, zfs_config_t, zfs_config_t)
|
|
|
|
manage_files_pattern(zed_t, zfs_runtime_t, zfs_runtime_t)
|
|
files_runtime_filetrans(zed_t, zfs_runtime_t, file)
|
|
|
|
# to execute scripts in /usr/libexec/zfs
|
|
corecmd_exec_bin(zed_t)
|
|
corecmd_exec_shell(zed_t)
|
|
|
|
dev_rw_sysfs(zed_t)
|
|
|
|
files_search_etc(zed_t)
|
|
|
|
kernel_read_system_state(zed_t)
|
|
kernel_read_vm_overcommit_sysctl(zed_t)
|
|
|
|
storage_raw_rw_fixed_disk(zed_t)
|
|
|
|
auth_use_nsswitch(zed_t)
|
|
|
|
hostname_exec(zed_t)
|
|
|
|
logging_send_syslog_msg(zed_t)
|
|
|
|
miscfiles_read_localization(zed_t)
|
|
|
|
udev_search_runtime(zed_t)
|
|
|
|
zfs_rw_zpool_cache(zed_t)
|
|
|
|
optional_policy(`
|
|
# for managing /etc/exports.d/zfs.exports
|
|
rpc_create_exports(zed_t)
|
|
rpc_write_exports(zed_t)
|
|
')
|
|
|
|
########################################
|
|
#
|
|
# zfs local policy
|
|
#
|
|
|
|
allow zfs_t self:process { getsched signal signull };
|
|
allow zfs_t self:capability { sys_admin sys_rawio };
|
|
allow zfs_t self:fifo_file rw_fifo_file_perms;
|
|
|
|
list_dirs_pattern(zfs_t, zfs_config_t, zfs_config_t)
|
|
read_files_pattern(zfs_t, zfs_config_t, zfs_config_t)
|
|
read_lnk_files_pattern(zfs_t, zfs_config_t, zfs_config_t)
|
|
|
|
manage_dirs_pattern(zfs_t, zfs_runtime_t, zfs_runtime_t)
|
|
manage_files_pattern(zfs_t, zfs_runtime_t, zfs_runtime_t)
|
|
files_runtime_filetrans(zfs_t, zfs_runtime_t, { dir file })
|
|
|
|
# to execute scripts in /usr/libexec/zfs
|
|
corecmd_exec_bin(zfs_t)
|
|
corecmd_exec_shell(zfs_t)
|
|
|
|
dev_delete_generic_symlinks(zfs_t)
|
|
dev_getattr_sysfs(zfs_t)
|
|
dev_read_sysfs(zfs_t)
|
|
|
|
domain_use_interactive_fds(zfs_t)
|
|
|
|
files_getattr_all_dirs(zfs_t)
|
|
files_mounton_all_mountpoints(zfs_t)
|
|
files_search_etc(zfs_t)
|
|
|
|
fs_getattr_xattr_fs(zfs_t)
|
|
fs_mount_xattr_fs(zfs_t)
|
|
fs_unmount_xattr_fs(zfs_t)
|
|
fs_remount_xattr_fs(zfs_t)
|
|
fs_relabelfrom_xattr_fs(zfs_t)
|
|
fs_ioctl_cgroup_dirs(zfs_t)
|
|
fs_rw_nfsd_fs(zfs_t)
|
|
|
|
kernel_read_fs_sysctls(zfs_t)
|
|
kernel_read_kernel_sysctls(zfs_t)
|
|
kernel_read_system_state(zfs_t)
|
|
|
|
storage_raw_rw_fixed_disk(zfs_t)
|
|
|
|
udev_read_runtime_files(zfs_t)
|
|
|
|
miscfiles_read_localization(zfs_t)
|
|
|
|
auth_use_nsswitch(zfs_t)
|
|
|
|
mount_exec(zfs_t)
|
|
|
|
userdom_use_user_terminals(zfs_t)
|
|
|
|
zfs_rw_zpool_cache(zfs_t)
|
|
|
|
optional_policy(`
|
|
fstools_manage_runtime_files(zfs_t)
|
|
fstools_runtime_filetrans(zfs_t, dir, "blkid")
|
|
')
|
|
|
|
optional_policy(`
|
|
kernel_rw_rpc_sysctls(zfs_t)
|
|
|
|
rpc_manage_nfs_state_data(zfs_t)
|
|
rpc_list_exports(zfs_t)
|
|
rpc_create_exports(zfs_t)
|
|
rpc_read_exports(zfs_t)
|
|
rpc_write_exports(zfs_t)
|
|
')
|
|
|
|
#######################################
|
|
#
|
|
# Mail local policy
|
|
#
|
|
|
|
optional_policy(`
|
|
mta_base_mail_template(zed)
|
|
role system_r types zed_mail_t;
|
|
|
|
allow zed_mail_t zed_t:fd use;
|
|
allow zed_mail_t zed_t:fifo_file rw_fifo_file_perms;
|
|
allow zed_mail_t zed_t:process sigchld;
|
|
|
|
manage_dirs_pattern(zed_t, zed_mail_tmp_t, zed_mail_tmp_t)
|
|
manage_files_pattern(zed_t, zed_mail_tmp_t, zed_mail_tmp_t)
|
|
files_tmp_filetrans(zed_t, zed_mail_tmp_t, { dir file })
|
|
|
|
allow zfs_t zed_mail_tmp_t:file write_file_perms;
|
|
|
|
mta_sendmail_domtrans(zed_t, zed_mail_t)
|
|
|
|
allow zed_mail_t self:capability { dac_override dac_read_search };
|
|
|
|
storage_dontaudit_read_fixed_disk(zed_mail_t)
|
|
storage_dontaudit_write_fixed_disk(zed_mail_t)
|
|
')
|