All of lore.kernel.org
 help / color / mirror / Atom feed
* [refpolicy] [PATCH 0/2] label some character device nodes
@ 2012-08-31 17:38 Dominick Grift
  2012-08-31 17:38 ` [refpolicy] [PATCH 1/2] Declare a loop control device node type and label /dev/loop-control accordingly Dominick Grift
  2012-08-31 17:38 ` [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly Dominick Grift
  0 siblings, 2 replies; 9+ messages in thread
From: Dominick Grift @ 2012-08-31 17:38 UTC (permalink / raw)
  To: refpolicy

I am currently trying to get refpolicy to work in a nobase text
kvm-guest, to see if i can come up with a better policy for systemd.

In the process is stumbled upon some unlabeled character device nodes.

Dominick Grift (2):
  Declare a loop control device node type and label /dev/loop-control  
      accordingly
  Declare a virtio port device type and label /dev/vport.* accordingly

 policy/modules/kernel/devices.fc | 2 ++
 policy/modules/kernel/devices.te | 6 ++++++
 2 files changed, 8 insertions(+)

-- 
1.7.11.4

^ permalink raw reply	[flat|nested] 9+ messages in thread
* [refpolicy] [PATCH 1/2] Declare a loop control device node type and label /dev/loop-control accordingly
  2012-08-31 17:38 [refpolicy] [PATCH 0/2] label some character device nodes Dominick Grift
@ 2012-08-31 17:38 ` Dominick Grift
  2012-09-05 17:45   ` Christopher J. PeBenito
  2012-08-31 17:38 ` [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly Dominick Grift
  1 sibling, 1 reply; 9+ messages in thread
From: Dominick Grift @ 2012-08-31 17:38 UTC (permalink / raw)
  To: refpolicy

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
---
 policy/modules/kernel/devices.fc | 1 +
 policy/modules/kernel/devices.te | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index 84e7337..5214c08 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -57,6 +57,7 @@
 /dev/lirc[0-9]+		-c	gen_context(system_u:object_r:lirc_device_t,s0)
 /dev/lircm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/logibm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
+/dev/loop-control	-c	gen_context(system_u:object_r:loop_control_device_t,s0)
 /dev/lp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
 /dev/mcelog		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
 /dev/mei		-c	gen_context(system_u:object_r:mei_device_t,s0)
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index 17e0915..99fe460 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -115,6 +115,9 @@ dev_node(kvm_device_t)
 type lirc_device_t;
 dev_node(lirc_device_t)
 
+type loop_control_device_t;
+dev_node(loop_control_device_t)
+
 #
 # Type for /dev/mapper/control
 #
-- 
1.7.11.4

^ permalink raw reply related	[flat|nested] 9+ messages in thread
* [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly
  2012-08-31 17:38 [refpolicy] [PATCH 0/2] label some character device nodes Dominick Grift
  2012-08-31 17:38 ` [refpolicy] [PATCH 1/2] Declare a loop control device node type and label /dev/loop-control accordingly Dominick Grift
@ 2012-08-31 17:38 ` Dominick Grift
  2012-09-04 10:28   ` Miroslav Grepl
  1 sibling, 1 reply; 9+ messages in thread
From: Dominick Grift @ 2012-08-31 17:38 UTC (permalink / raw)
  To: refpolicy

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
---
 policy/modules/kernel/devices.fc | 1 +
 policy/modules/kernel/devices.te | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index 5214c08..94505c4 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -124,6 +124,7 @@ ifdef(`distro_suse', `
 /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
 /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
 /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
+/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
 /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
 /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
 /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index 99fe460..52c535d 100644
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -272,6 +272,9 @@ dev_node(v4l_device_t)
 type vhost_device_t;
 dev_node(vhost_device_t)
 
+type virtio_device_t;
+dev_node(virtio_device_t)
+
 # Type for vmware devices.
 type vmware_device_t;
 dev_node(vmware_device_t)
-- 
1.7.11.4

^ permalink raw reply related	[flat|nested] 9+ messages in thread
* [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly
  2012-08-31 17:38 ` [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly Dominick Grift
@ 2012-09-04 10:28   ` Miroslav Grepl
  2012-09-04 12:50     ` Dominick Grift
  0 siblings, 1 reply; 9+ messages in thread
From: Miroslav Grepl @ 2012-09-04 10:28 UTC (permalink / raw)
  To: refpolicy

On 08/31/2012 07:38 PM, Dominick Grift wrote:
> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> ---
>   policy/modules/kernel/devices.fc | 1 +
>   policy/modules/kernel/devices.te | 3 +++
>   2 files changed, 4 insertions(+)
>
> diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
> index 5214c08..94505c4 100644
> --- a/policy/modules/kernel/devices.fc
> +++ b/policy/modules/kernel/devices.fc
> @@ -124,6 +124,7 @@ ifdef(`distro_suse', `
>   /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
>   /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
>   /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
> +/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
>   /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
>   /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
>   /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
> diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
> index 99fe460..52c535d 100644
> --- a/policy/modules/kernel/devices.te
> +++ b/policy/modules/kernel/devices.te
> @@ -272,6 +272,9 @@ dev_node(v4l_device_t)
>   type vhost_device_t;
>   dev_node(vhost_device_t)
>   
> +type virtio_device_t;
> +dev_node(virtio_device_t)
> +
>   # Type for vmware devices.
>   type vmware_device_t;
>   dev_node(vmware_device_t)
We declare it in terminal.* policy files.

Also I think base access interfaces should be part of this patch?

^ permalink raw reply	[flat|nested] 9+ messages in thread
* [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly
  2012-09-04 10:28   ` Miroslav Grepl
@ 2012-09-04 12:50     ` Dominick Grift
  2012-09-04 18:31       ` Miroslav Grepl
  0 siblings, 1 reply; 9+ messages in thread
From: Dominick Grift @ 2012-09-04 12:50 UTC (permalink / raw)
  To: refpolicy



On Tue, 2012-09-04 at 12:28 +0200, Miroslav Grepl wrote:
> On 08/31/2012 07:38 PM, Dominick Grift wrote:
> > Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> > ---
> >   policy/modules/kernel/devices.fc | 1 +
> >   policy/modules/kernel/devices.te | 3 +++
> >   2 files changed, 4 insertions(+)
> >
> > diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
> > index 5214c08..94505c4 100644
> > --- a/policy/modules/kernel/devices.fc
> > +++ b/policy/modules/kernel/devices.fc
> > @@ -124,6 +124,7 @@ ifdef(`distro_suse', `
> >   /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
> >   /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
> >   /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
> > +/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
> >   /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
> >   /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
> >   /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
> > diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
> > index 99fe460..52c535d 100644
> > --- a/policy/modules/kernel/devices.te
> > +++ b/policy/modules/kernel/devices.te
> > @@ -272,6 +272,9 @@ dev_node(v4l_device_t)
> >   type vhost_device_t;
> >   dev_node(vhost_device_t)
> >   
> > +type virtio_device_t;
> > +dev_node(virtio_device_t)
> > +
> >   # Type for vmware devices.
> >   type vmware_device_t;
> >   dev_node(vmware_device_t)
> We declare it in terminal.* policy files.

must be new then, last time i tried (a week ago on f18?) it was still
mislabeled (device_t)

> Also I think base access interfaces should be part of this patch?

i don't see that requirement. i also haven't encountered any process
trying to access it yet.

^ permalink raw reply	[flat|nested] 9+ messages in thread
* [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly
  2012-09-04 12:50     ` Dominick Grift
@ 2012-09-04 18:31       ` Miroslav Grepl
  2012-09-04 19:08         ` Dominick Grift
  2012-09-04 19:23         ` Dominick Grift
  0 siblings, 2 replies; 9+ messages in thread
From: Miroslav Grepl @ 2012-09-04 18:31 UTC (permalink / raw)
  To: refpolicy

On 09/04/2012 02:50 PM, Dominick Grift wrote:
>
> On Tue, 2012-09-04 at 12:28 +0200, Miroslav Grepl wrote:
>> On 08/31/2012 07:38 PM, Dominick Grift wrote:
>>> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
>>> ---
>>>    policy/modules/kernel/devices.fc | 1 +
>>>    policy/modules/kernel/devices.te | 3 +++
>>>    2 files changed, 4 insertions(+)
>>>
>>> diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
>>> index 5214c08..94505c4 100644
>>> --- a/policy/modules/kernel/devices.fc
>>> +++ b/policy/modules/kernel/devices.fc
>>> @@ -124,6 +124,7 @@ ifdef(`distro_suse', `
>>>    /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
>>>    /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
>>>    /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
>>> +/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
>>>    /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
>>>    /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
>>>    /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
>>> diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
>>> index 99fe460..52c535d 100644
>>> --- a/policy/modules/kernel/devices.te
>>> +++ b/policy/modules/kernel/devices.te
>>> @@ -272,6 +272,9 @@ dev_node(v4l_device_t)
>>>    type vhost_device_t;
>>>    dev_node(vhost_device_t)
>>>    
>>> +type virtio_device_t;
>>> +dev_node(virtio_device_t)
>>> +
>>>    # Type for vmware devices.
>>>    type vmware_device_t;
>>>    dev_node(vmware_device_t)
>> We declare it in terminal.* policy files.
> must be new then, last time i tried (a week ago on f18?) it was still
> mislabeled (device_t)
We have

/dev/vport[0-9]p[0-9]+  -c gen_context(system_u:object_r:virtio_device_t,s0)

maybe it needs to be fixed.

And then

rhev.te:term_use_virtio_console(rhev_agentd_t)
rhev.te:    term_use_virtio_console(rhev_agentd_consolehelper_t)
vdagent.te:term_use_virtio_console(vdagent_t)

>
>> Also I think base access interfaces should be part of this patch?
> i don't see that requirement. i also haven't encountered any process
> trying to access it yet.
>

^ permalink raw reply	[flat|nested] 9+ messages in thread
* [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly
  2012-09-04 18:31       ` Miroslav Grepl
@ 2012-09-04 19:08         ` Dominick Grift
  2012-09-04 19:23         ` Dominick Grift
  1 sibling, 0 replies; 9+ messages in thread
From: Dominick Grift @ 2012-09-04 19:08 UTC (permalink / raw)
  To: refpolicy



On Tue, 2012-09-04 at 20:31 +0200, Miroslav Grepl wrote:

> 
> /dev/vport[0-9]p[0-9]+  -c gen_context(system_u:object_r:virtio_device_t,s0)
> 
> maybe it needs to be fixed.
> 
> And then
> 
> rhev.te:term_use_virtio_console(rhev_agentd_t)
> rhev.te:    term_use_virtio_console(rhev_agentd_consolehelper_t)
> vdagent.te:term_use_virtio_console(vdagent_t)

could you please create a patch for refpolicy that fixes this issue? I
would do it but i screwed up my refpolicy repository and cant undo it
right now because i am in the middle of a project.

But if you do , please double check the file context spec becuase i
suspect that it may not catch the interface. (i submitted this patch
because the device was mislabeled)

> >
> >> Also I think base access interfaces should be part of this patch?
> > i don't see that requirement. i also haven't encountered any process
> > trying to access it yet.
> >
> 

^ permalink raw reply	[flat|nested] 9+ messages in thread
* [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly
  2012-09-04 18:31       ` Miroslav Grepl
  2012-09-04 19:08         ` Dominick Grift
@ 2012-09-04 19:23         ` Dominick Grift
  1 sibling, 0 replies; 9+ messages in thread
From: Dominick Grift @ 2012-09-04 19:23 UTC (permalink / raw)
  To: refpolicy



On Tue, 2012-09-04 at 20:31 +0200, Miroslav Grepl wrote:
> On 09/04/2012 02:50 PM, Dominick Grift wrote:
> >
> > On Tue, 2012-09-04 at 12:28 +0200, Miroslav Grepl wrote:
> >> On 08/31/2012 07:38 PM, Dominick Grift wrote:
> >>> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> >>> ---
> >>>    policy/modules/kernel/devices.fc | 1 +
> >>>    policy/modules/kernel/devices.te | 3 +++
> >>>    2 files changed, 4 insertions(+)
> >>>
> >>> diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
> >>> index 5214c08..94505c4 100644
> >>> --- a/policy/modules/kernel/devices.fc
> >>> +++ b/policy/modules/kernel/devices.fc
> >>> @@ -124,6 +124,7 @@ ifdef(`distro_suse', `
> >>>    /dev/vmmon		-c	gen_context(system_u:object_r:vmware_device_t,s0)
> >>>    /dev/vmnet.*		-c	gen_context(system_u:object_r:vmware_device_t,s0)
> >>>    /dev/video.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
> >>> +/dev/vport.*		-c	gen_context(system_u:object_r:virtio_device_t,s0)
> >>>    /dev/vrtpanel		-c	gen_context(system_u:object_r:mouse_device_t,s0)
> >>>    /dev/vttuner		-c	gen_context(system_u:object_r:v4l_device_t,s0)
> >>>    /dev/vtx.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
> >>> diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
> >>> index 99fe460..52c535d 100644
> >>> --- a/policy/modules/kernel/devices.te
> >>> +++ b/policy/modules/kernel/devices.te
> >>> @@ -272,6 +272,9 @@ dev_node(v4l_device_t)
> >>>    type vhost_device_t;
> >>>    dev_node(vhost_device_t)
> >>>    
> >>> +type virtio_device_t;
> >>> +dev_node(virtio_device_t)
> >>> +
> >>>    # Type for vmware devices.
> >>>    type vmware_device_t;
> >>>    dev_node(vmware_device_t)
> >> We declare it in terminal.* policy files.
> > must be new then, last time i tried (a week ago on f18?) it was still
> > mislabeled (device_t)
> We have
> 
> /dev/vport[0-9]p[0-9]+  -c gen_context(system_u:object_r:virtio_device_t,s0)
> 
> maybe it needs to be fixed.
> 
> And then
> 
> rhev.te:term_use_virtio_console(rhev_agentd_t)
> rhev.te:    term_use_virtio_console(rhev_agentd_consolehelper_t)
> vdagent.te:term_use_virtio_console(vdagent_t)
> 
> >
> >> Also I think base access interfaces should be part of this patch?
> > i don't see that requirement. i also haven't encountered any process
> > trying to access it yet.
> >
> 

never mind, this patch was not merged.

so just ignore this patch

^ permalink raw reply	[flat|nested] 9+ messages in thread
* [refpolicy] [PATCH 1/2] Declare a loop control device node type and label /dev/loop-control accordingly
  2012-08-31 17:38 ` [refpolicy] [PATCH 1/2] Declare a loop control device node type and label /dev/loop-control accordingly Dominick Grift
@ 2012-09-05 17:45   ` Christopher J. PeBenito
  0 siblings, 0 replies; 9+ messages in thread
From: Christopher J. PeBenito @ 2012-09-05 17:45 UTC (permalink / raw)
  To: refpolicy

On 08/31/12 13:38, Dominick Grift wrote:
> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> ---
>  policy/modules/kernel/devices.fc | 1 +
>  policy/modules/kernel/devices.te | 3 +++
>  2 files changed, 4 insertions(+)
> 
> diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
> index 84e7337..5214c08 100644
> --- a/policy/modules/kernel/devices.fc
> +++ b/policy/modules/kernel/devices.fc
> @@ -57,6 +57,7 @@
>  /dev/lirc[0-9]+		-c	gen_context(system_u:object_r:lirc_device_t,s0)
>  /dev/lircm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
>  /dev/logibm		-c	gen_context(system_u:object_r:mouse_device_t,s0)
> +/dev/loop-control	-c	gen_context(system_u:object_r:loop_control_device_t,s0)
>  /dev/lp.*		-c	gen_context(system_u:object_r:printer_device_t,s0)
>  /dev/mcelog		-c	gen_context(system_u:object_r:kmsg_device_t,mls_systemhigh)
>  /dev/mei		-c	gen_context(system_u:object_r:mei_device_t,s0)
> diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
> index 17e0915..99fe460 100644
> --- a/policy/modules/kernel/devices.te
> +++ b/policy/modules/kernel/devices.te
> @@ -115,6 +115,9 @@ dev_node(kvm_device_t)
>  type lirc_device_t;
>  dev_node(lirc_device_t)
>  
> +type loop_control_device_t;
> +dev_node(loop_control_device_t)
> +
>  #
>  # Type for /dev/mapper/control
>  #
> 

Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com

^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2012-09-05 17:45 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-08-31 17:38 [refpolicy] [PATCH 0/2] label some character device nodes Dominick Grift
2012-08-31 17:38 ` [refpolicy] [PATCH 1/2] Declare a loop control device node type and label /dev/loop-control accordingly Dominick Grift
2012-09-05 17:45   ` Christopher J. PeBenito
2012-08-31 17:38 ` [refpolicy] [PATCH 2/2] Declare a virtio port device type and label /dev/vport.* accordingly Dominick Grift
2012-09-04 10:28   ` Miroslav Grepl
2012-09-04 12:50     ` Dominick Grift
2012-09-04 18:31       ` Miroslav Grepl
2012-09-04 19:08         ` Dominick Grift
2012-09-04 19:23         ` Dominick Grift

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.