selinux-refpolicy.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Russell Coker <russell@coker.com.au>
To: "selinux-refpolicy@vger.kernel.org"  <selinux-refpolicy@vger.kernel.org>
Subject: [PATCH] more tiny stuff
Date: Sat, 19 Jan 2019 23:04:44 +1100	[thread overview]
Message-ID: <20190119120444.GA1199@xev> (raw)

I think the old timesync labelling wasn't working anyway due to -- for a
directory name.

A couple of patches for devicekit calling dmidecode (this is part of replacing
some kmem access that was discussed on this list and rejected as a misfeature
in Debian DMI related code ages ago).

The rest should be obvious.

Index: refpolicy-2.20180701/policy/modules/services/ntp.fc
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ntp.fc
+++ refpolicy-2.20180701/policy/modules/services/ntp.fc
@@ -32,7 +32,7 @@
 /var/lib/ntp(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
 /var/lib/sntp-kod(/.*)?				gen_context(system_u:object_r:ntp_drift_t,s0)
 /var/lib/systemd/clock			--	gen_context(system_u:object_r:ntp_drift_t,s0)
-/var/lib/private/systemd/timesync(/.*)? --	gen_context(system_u:object_r:ntp_drift_t,s0)
+/var/lib/systemd/timesync(/.*)?			gen_context(system_u:object_r:ntp_drift_t,s0)
 
 /var/lock/ntpdate                       --      gen_context(system_u:object_r:ntpd_lock_t,s0)
 
Index: refpolicy-2.20180701/policy/modules/admin/dmidecode.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/admin/dmidecode.te
+++ refpolicy-2.20180701/policy/modules/admin/dmidecode.te
@@ -32,3 +32,9 @@ mls_file_read_all_levels(dmidecode_t)
 locallogin_use_fds(dmidecode_t)
 
 userdom_use_inherited_user_terminals(dmidecode_t)
+
+ifdef(`init_systemd',`
+	# inherits /dev/null and a socket from devicekit_disk_t
+	init_use_fds(dmidecode_t)
+	init_rw_inherited_stream_socket(dmidecode_t)
+')
Index: refpolicy-2.20180701/policy/modules/services/devicekit.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/devicekit.te
+++ refpolicy-2.20180701/policy/modules/services/devicekit.te
@@ -177,6 +177,10 @@ optional_policy(`
 ')
 
 optional_policy(`
+	dmidecode_domtrans(devicekit_disk_t)
+')
+
+optional_policy(`
 	fstools_domtrans(devicekit_disk_t)
 ')
 
Index: refpolicy-2.20180701/policy/modules/services/xserver.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/xserver.te
+++ refpolicy-2.20180701/policy/modules/services/xserver.te
@@ -291,6 +291,8 @@ kernel_request_load_module(xauth_t)
 
 domain_use_interactive_fds(xauth_t)
 
+dev_read_sysfs(xauth_t)
+
 files_read_etc_files(xauth_t)
 files_search_pids(xauth_t)
 
Index: refpolicy-2.20180701/policy/modules/system/unconfined.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/system/unconfined.te
+++ refpolicy-2.20180701/policy/modules/system/unconfined.te
@@ -59,6 +59,9 @@ ifdef(`direct_sysadm_daemon',`
 ')
 
 ifdef(`init_systemd',`
+	# for systemd-analyze
+	init_service_status(unconfined_t)
+
 	optional_policy(`
 		systemd_dbus_chat_resolved(unconfined_t)
 	')

             reply	other threads:[~2019-01-19 12:04 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-01-19 12:04 Russell Coker [this message]
2019-01-19 12:14 ` [PATCH] more tiny stuff Dominick Grift
2019-01-20 21:22 ` Chris PeBenito

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190119120444.GA1199@xev \
    --to=russell@coker.com.au \
    --cc=selinux-refpolicy@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).