diff options
author | Dave Sugar <dsugar@tresys.com> | 2018-06-07 15:19:40 -0400 |
---|---|---|
committer | Jason Zaman <jason@perfinion.com> | 2018-06-08 17:21:01 +0800 |
commit | 511e0ce6b19693fe93b764828f9d2a4427166981 (patch) | |
tree | c4557cc551305fa5238757877feb5ac8c62df956 | |
parent | policy for systemd-update-done (diff) | |
download | hardened-refpolicy-511e0ce6b19693fe93b764828f9d2a4427166981.tar.gz hardened-refpolicy-511e0ce6b19693fe93b764828f9d2a4427166981.tar.bz2 hardened-refpolicy-511e0ce6b19693fe93b764828f9d2a4427166981.zip |
policy for systemd-hwdb
systemd-hwdb rebuilds /etc/udev/hwdb.bin from files in /var/lib/udev/hwdb.d/*
making a temp file first in /etc/udev/ then moving the tmp file
over hwdb.bin when complete. It also relabels based in file_contexts
This provides private type for /etc/udev/hwdb.bin
Signed-off-by: Dave Sugar <dsugar@tresys.com>
-rw-r--r-- | policy/modules/system/systemd.fc | 3 | ||||
-rw-r--r-- | policy/modules/system/systemd.if | 19 | ||||
-rw-r--r-- | policy/modules/system/systemd.te | 24 | ||||
-rw-r--r-- | policy/modules/system/udev.te | 1 |
4 files changed, 47 insertions, 0 deletions
diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc index 5d4857e4..df1a4b2e 100644 --- a/policy/modules/system/systemd.fc +++ b/policy/modules/system/systemd.fc @@ -2,6 +2,7 @@ /usr/bin/systemd-cgtop -- gen_context(system_u:object_r:systemd_cgtop_exec_t,s0) /usr/bin/systemd-coredump -- gen_context(system_u:object_r:systemd_coredump_exec_t,s0) /usr/bin/systemd-detect-virt -- gen_context(system_u:object_r:systemd_detect_virt_exec_t,s0) +/usr/bin/systemd-hwdb -- gen_context(system_u:object_r:systemd_hw_exec_t,s0) /usr/bin/systemd-nspawn -- gen_context(system_u:object_r:systemd_nspawn_exec_t,s0) /usr/bin/systemd-run -- gen_context(system_u:object_r:systemd_run_exec_t,s0) /usr/bin/systemd-stdio-bridge -- gen_context(system_u:object_r:systemd_stdio_bridge_exec_t,s0) @@ -38,6 +39,8 @@ /usr/lib/systemd/system/systemd-binfmt.* -- gen_context(system_u:object_r:systemd_binfmt_unit_t,s0) /usr/lib/systemd/system/systemd-networkd.* gen_context(system_u:object_r:systemd_networkd_unit_t,s0) +/etc/udev/hwdb.bin -- gen_context(system_u:object_r:systemd_hwdb_t,s0) + /var/lib/systemd/backlight(/.*)? gen_context(system_u:object_r:systemd_backlight_var_lib_t,s0) /var/lib/systemd/coredump(/.*)? gen_context(system_u:object_r:systemd_coredump_var_lib_t,s0) /var/lib/systemd/linger(/.*)? gen_context(system_u:object_r:systemd_logind_var_lib_t,s0) diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if index fd501c52..75bbeead 100644 --- a/policy/modules/system/systemd.if +++ b/policy/modules/system/systemd.if @@ -772,5 +772,24 @@ interface(`systemd_getattr_updated_runtime',` ') +####################################### +## <summary> +## Allow domain to read udev hwdb file +## </summary> +## <param name="domain"> +## <summary> +## domain allowed access +## </summary> +## </param> +# +interface(`systemd_read_hwdb',` + gen_require(` + type systemd_hwdb_t; + ') + + read_files_pattern($1, systemd_hwdb_t, systemd_hwdb_t) +') + + diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te index 15fe6e1b..c324d3bf 100644 --- a/policy/modules/system/systemd.te +++ b/policy/modules/system/systemd.te @@ -81,6 +81,13 @@ type systemd_hostnamed_t; type systemd_hostnamed_exec_t; init_daemon_domain(systemd_hostnamed_t, systemd_hostnamed_exec_t) +type systemd_hw_t; +type systemd_hw_exec_t; +init_system_domain(systemd_hw_t, systemd_hw_exec_t) + +type systemd_hwdb_t; +files_type(systemd_hwdb_t); + type systemd_journal_t; files_type(systemd_journal_t) logging_log_file(systemd_journal_t) @@ -322,6 +329,23 @@ optional_policy(` networkmanager_dbus_chat(systemd_hostnamed_t) ') +######################################### +# +# hw local policy +# + +allow systemd_hw_t systemd_hwdb_t:file { manage_file_perms relabelfrom relabelto }; + +files_etc_filetrans(systemd_hw_t, systemd_hwdb_t, file) +files_search_pids(systemd_hw_t) + +init_read_state(systemd_hw_t) + +selinux_get_fs_mount(systemd_hw_t) + +seutil_read_config(systemd_hw_t) +seutil_read_file_contexts(systemd_hw_t) + ####################################### # # locale local policy diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te index 093029aa..c3929f6d 100644 --- a/policy/modules/system/udev.te +++ b/policy/modules/system/udev.te @@ -248,6 +248,7 @@ ifdef(`init_systemd',` init_get_generic_units_status(udev_t) init_stream_connect(udev_t) + systemd_read_hwdb(udev_t) systemd_read_logind_sessions_files(udev_t) systemd_read_logind_pids(udev_t) |