[selinux-policy: 2566/3172] Virt patch from Dan Walsh.
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 22:48:03 UTC 2010
commit 7630200e1b43339f5d62eeb7ba3a1b48138b0399
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Mon Mar 22 10:24:34 2010 -0400
Virt patch from Dan Walsh.
policy/modules/services/virt.fc | 4 +++
policy/modules/services/virt.if | 13 +++++++++-
policy/modules/services/virt.te | 48 ++++++++++++++++++++++++++++++++++-----
3 files changed, 58 insertions(+), 7 deletions(-)
---
diff --git a/policy/modules/services/virt.fc b/policy/modules/services/virt.fc
index 1116f4f..2124b6a 100644
--- a/policy/modules/services/virt.fc
+++ b/policy/modules/services/virt.fc
@@ -7,6 +7,10 @@ HOME_DIR/VirtualMachines/isos(/.*)? gen_context(system_u:object_r:virt_content_t
/etc/libvirt/[^/]* -d gen_context(system_u:object_r:virt_etc_rw_t,s0)
/etc/libvirt/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0)
/etc/rc\.d/init\.d/libvirtd -- gen_context(system_u:object_r:virtd_initrc_exec_t,s0)
+/etc/xen -d gen_context(system_u:object_r:virt_etc_t,s0)
+/etc/xen/[^/]* -- gen_context(system_u:object_r:virt_etc_t,s0)
+/etc/xen/[^/]* -d gen_context(system_u:object_r:virt_etc_rw_t,s0)
+/etc/xen/.*/.* gen_context(system_u:object_r:virt_etc_rw_t,s0)
/usr/sbin/libvirtd -- gen_context(system_u:object_r:virtd_exec_t,s0)
diff --git a/policy/modules/services/virt.if b/policy/modules/services/virt.if
index 92b6ca4..7bb17f6 100644
--- a/policy/modules/services/virt.if
+++ b/policy/modules/services/virt.if
@@ -20,8 +20,12 @@ template(`virt_domain_template',`
type $1_t, virt_domain;
domain_type($1_t)
+ domain_user_exemption_target($1_t)
role system_r types $1_t;
+ type $1_devpts_t;
+ term_pty($1_devpts_t)
+
type $1_tmp_t;
files_tmp_file($1_tmp_t)
@@ -35,6 +39,9 @@ template(`virt_domain_template',`
type $1_var_run_t;
files_pid_file($1_var_run_t)
+ allow $1_t $1_devpts_t:chr_file { rw_chr_file_perms setattr };
+ term_create_pty($1_t, $1_devpts_t)
+
manage_dirs_pattern($1_t, $1_image_t, $1_image_t)
manage_files_pattern($1_t, $1_image_t, $1_image_t)
read_lnk_files_pattern($1_t, $1_image_t, $1_image_t)
@@ -62,6 +69,9 @@ template(`virt_domain_template',`
files_pid_filetrans($1_t, $1_var_run_t, { dir file })
stream_connect_pattern($1_t, $1_var_run_t, $1_var_run_t, virtd_t)
+ optional_policy(`
+ xserver_rw_shm($1_t)
+ ')
')
########################################
@@ -293,6 +303,7 @@ interface(`virt_read_lib_files',`
files_search_var_lib($1)
read_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
+ read_lnk_files_pattern($1, virt_var_lib_t, virt_var_lib_t)
')
########################################
@@ -471,7 +482,7 @@ interface(`virt_manage_images',`
########################################
## <summary>
-## All of the rules required to administrate
+## All of the rules required to administrate
## an virt environment
## </summary>
## <param name="domain">
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index b02d62c..a2989cd 100644
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -1,5 +1,5 @@
-policy_module(virt, 1.3.1)
+policy_module(virt, 1.3.2)
########################################
#
@@ -15,6 +15,13 @@ gen_tunable(virt_use_comm, false)
## <desc>
## <p>
+## Allow virt to read fuse files
+## </p>
+## </desc>
+gen_tunable(virt_use_fusefs, false)
+
+## <desc>
+## <p>
## Allow virt to manage nfs files
## </p>
## </desc>
@@ -84,11 +91,11 @@ type virtd_initrc_exec_t;
init_script_file(virtd_initrc_exec_t)
ifdef(`enable_mcs',`
- init_ranged_daemon_domain(virtd_t, virtd_exec_t,s0 - mcs_systemhigh)
+ init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mcs_systemhigh)
')
ifdef(`enable_mls',`
- init_ranged_daemon_domain(virtd_t, virtd_exec_t,s0 - mls_systemhigh)
+ init_ranged_daemon_domain(virtd_t, virtd_exec_t, s0 - mls_systemhigh)
')
########################################
@@ -107,6 +114,7 @@ read_lnk_files_pattern(svirt_t, virt_image_t, virt_image_t)
allow svirt_t svirt_image_t:dir search_dir_perms;
manage_dirs_pattern(svirt_t, svirt_image_t, svirt_image_t)
manage_files_pattern(svirt_t, svirt_image_t, svirt_image_t)
+fs_hugetlbfs_filetrans(svirt_t, svirt_image_t, file)
list_dirs_pattern(svirt_t, virt_content_t, virt_content_t)
read_files_pattern(svirt_t, virt_content_t, virt_content_t)
@@ -118,10 +126,13 @@ corenet_udp_sendrecv_generic_node(svirt_t)
corenet_udp_sendrecv_all_ports(svirt_t)
corenet_udp_bind_generic_node(svirt_t)
corenet_udp_bind_all_ports(svirt_t)
+corenet_tcp_bind_all_ports(svirt_t)
+corenet_tcp_connect_all_ports(svirt_t)
dev_list_sysfs(svirt_t)
userdom_search_user_home_content(svirt_t)
+userdom_read_user_home_content_symlinks(svirt_t)
userdom_read_all_users_state(svirt_t)
tunable_policy(`virt_use_comm',`
@@ -129,6 +140,11 @@ tunable_policy(`virt_use_comm',`
dev_rw_printer(svirt_t)
')
+tunable_policy(`virt_use_fusefs',`
+ fs_read_fusefs_files(svirt_t)
+ fs_read_fusefs_symlinks(svirt_t)
+')
+
tunable_policy(`virt_use_nfs',`
fs_manage_nfs_dirs(svirt_t)
fs_manage_nfs_files(svirt_t)
@@ -153,6 +169,10 @@ optional_policy(`
xen_rw_image_files(svirt_t)
')
+optional_policy(`
+ xen_rw_image_files(svirt_t)
+')
+
########################################
#
# virtd local policy
@@ -165,6 +185,7 @@ allow virtd_t self:fifo_file rw_fifo_file_perms;
allow virtd_t self:unix_stream_socket create_stream_socket_perms;
allow virtd_t self:tcp_socket create_stream_socket_perms;
allow virtd_t self:tun_socket create_socket_perms;
+allow virtd_t self:netlink_kobject_uevent_socket create_socket_perms;
manage_dirs_pattern(virtd_t, svirt_cache_t, svirt_cache_t)
manage_files_pattern(virtd_t, svirt_cache_t, svirt_cache_t)
@@ -226,6 +247,7 @@ dev_rw_sysfs(virtd_t)
dev_read_rand(virtd_t)
dev_rw_kvm(virtd_t)
dev_getattr_all_chr_files(virtd_t)
+dev_rw_mtrr(virtd_t)
# Init script handling
domain_use_interactive_fds(virtd_t)
@@ -243,6 +265,8 @@ fs_list_auto_mountpoints(virtd_t)
fs_getattr_xattr_fs(virtd_t)
fs_rw_anon_inodefs_files(virtd_t)
fs_list_inotifyfs(virtd_t)
+fs_manage_cgroup_dirs(virtd_t)
+fs_rw_cgroup_files(virtd_t)
mcs_process_set_categories(virtd_t)
@@ -259,8 +283,10 @@ auth_use_nsswitch(virtd_t)
miscfiles_read_localization(virtd_t)
miscfiles_read_certs(virtd_t)
+miscfiles_read_hwdata(virtd_t)
modutils_read_module_deps(virtd_t)
+modutils_read_module_config(virtd_t)
modutils_manage_module_config(virtd_t)
logging_send_syslog_msg(virtd_t)
@@ -332,7 +358,7 @@ optional_policy(`
')
optional_policy(`
- policykit_dbus_chat(virtd_t)
+ policykit_dbus_chat(virtd_t)
policykit_domtrans_auth(virtd_t)
policykit_domtrans_resolve(virtd_t)
policykit_read_lib(virtd_t)
@@ -343,6 +369,7 @@ optional_policy(`
qemu_read_state(virtd_t)
qemu_signal(virtd_t)
qemu_kill(virtd_t)
+ qemu_setsched(virtd_t)
')
optional_policy(`
@@ -360,6 +387,7 @@ optional_policy(`
optional_policy(`
udev_domtrans(virtd_t)
+ udev_read_db(virtd_t)
')
optional_policy(`
@@ -371,8 +399,8 @@ optional_policy(`
# virtual domains common policy
#
-allow virt_domain self:capability { dac_read_search dac_override };
-allow virt_domain self:process { execmem signal getsched signull };
+allow virt_domain self:capability { dac_read_search dac_override kill };
+allow virt_domain self:process { execmem execstack signal getsched signull };
allow virt_domain self:fifo_file rw_file_perms;
allow virt_domain self:shm create_shm_perms;
allow virt_domain self:unix_stream_socket create_stream_socket_perms;
@@ -399,7 +427,9 @@ corenet_rw_tun_tap_dev(virt_domain)
corenet_tcp_bind_virt_migration_port(virt_domain)
corenet_tcp_connect_virt_migration_port(virt_domain)
+dev_read_rand(virt_domain)
dev_read_sound(virt_domain)
+dev_read_urand(virt_domain)
dev_write_sound(virt_domain)
dev_rw_ksm(virt_domain)
dev_rw_kvm(virt_domain)
@@ -410,11 +440,17 @@ domain_use_interactive_fds(virt_domain)
files_read_etc_files(virt_domain)
files_read_usr_files(virt_domain)
files_read_var_files(virt_domain)
+files_search_all(virt_domain)
fs_getattr_tmpfs(virt_domain)
fs_rw_anon_inodefs_files(virt_domain)
fs_rw_tmpfs_files(virt_domain)
+term_use_all_terms(virt_domain)
+term_getattr_pty_fs(virt_domain)
+term_use_generic_ptys(virt_domain)
+term_use_ptmx(virt_domain)
+
auth_use_nsswitch(virt_domain)
logging_send_syslog_msg(virt_domain)
More information about the scm-commits
mailing list