From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <selinux-refpolicy-owner@kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
	by smtp.lore.kernel.org (Postfix) with ESMTP id EEFBAC433F5
	for <selinux-refpolicy@archiver.kernel.org>; Thu, 17 Feb 2022 02:50:29 +0000 (UTC)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S231587AbiBQCul (ORCPT
        <rfc822;selinux-refpolicy@archiver.kernel.org>);
        Wed, 16 Feb 2022 21:50:41 -0500
Received: from mxb-00190b01.gslb.pphosted.com ([23.128.96.19]:33528 "EHLO
        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S231570AbiBQCuk (ORCPT
        <rfc822;selinux-refpolicy@vger.kernel.org>);
        Wed, 16 Feb 2022 21:50:40 -0500
Received: from smtp.sws.net.au (smtp.sws.net.au [144.76.241.179])
        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F7172A82D0
        for <selinux-refpolicy@vger.kernel.org>; Wed, 16 Feb 2022 18:50:26 -0800 (PST)
Received: from xev.coker.com.au (localhost [127.0.0.1])
        by smtp.sws.net.au (Postfix) with ESMTP id 2D878F5DE
        for <selinux-refpolicy@vger.kernel.org>; Thu, 17 Feb 2022 13:50:24 +1100 (AEDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=coker.com.au;
        s=2008; t=1645066224;
        bh=EIFROsRx4x8QMWglrh/r3YfS06+AC+Nyl4dhMeTkbVY=; l=3800;
        h=Date:From:To:Subject:From;
        b=CfLllcD95CeBxp+D109Zod+3jd7/5f047djXUICX0qgiAJgNyIbiGXvQz9hl8rON+
         LgjPi259mIYQhxVWy+Vs2snWUnzfc6YOE7SncCzJxIEEeOqgbCe3+WsQEPqKEYlD0T
         3ss/vb2UtTEczyrU6g5rd4pemztByIis8ZL3xNI4=
Received: by xev.coker.com.au (Postfix, from userid 1001)
        id A5A6B1733DA4; Thu, 17 Feb 2022 13:50:19 +1100 (AEDT)
Date:   Thu, 17 Feb 2022 13:50:19 +1100
From:   Russell Coker <russell@coker.com.au>
To:     selinux-refpolicy@vger.kernel.org
Subject: [PATCH] rasdaemon policy
Message-ID: <Yg236z/zmxayCS5b@xev.coker.com.au>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Precedence: bulk
List-ID: <selinux-refpolicy.vger.kernel.org>
X-Mailing-List: selinux-refpolicy@vger.kernel.org

This is the policy for the Reliability, Availability, and Servicability
daemon.  It's designed to extract and log information on hardware events
on server hardware.

Signed-off-by: Russell Coker <russell@coker.com.au>

Index: refpolicy-2.20220217/policy/modules/kernel/filesystem.if
===================================================================
--- refpolicy-2.20220217.orig/policy/modules/kernel/filesystem.if
+++ refpolicy-2.20220217/policy/modules/kernel/filesystem.if
@@ -5485,6 +5485,43 @@ interface(`fs_getattr_tracefs_files',`
 
 ########################################
 ## <summary>
+##	Read/write trace filesystem files
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`fs_write_tracefs_files',`
+	gen_require(`
+		type tracefs_t;
+	')
+
+	allow $1 tracefs_t:dir list_dir_perms;
+	allow $1 tracefs_t:file rw_file_perms;
+')
+
+########################################
+## <summary>
+##	create trace filesystem directories
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`fs_create_tracefs_dirs',`
+	gen_require(`
+		type tracefs_t;
+	')
+
+	allow $1 tracefs_t:dir { create rw_dir_perms };
+')
+
+########################################
+## <summary>
 ##	Mount a XENFS filesystem.
 ## </summary>
 ## <param name="domain">
Index: refpolicy-2.20220217/policy/modules/services/rasdaemon.fc
===================================================================
--- /dev/null
+++ refpolicy-2.20220217/policy/modules/services/rasdaemon.fc
@@ -0,0 +1,3 @@
+/usr/sbin/rasdaemon			--	gen_context(system_u:object_r:rasdaemon_exec_t,s0)
+/var/lib/rasdaemon(/.*)?			gen_context(system_u:object_r:rasdaemon_var_t,s0)
+
Index: refpolicy-2.20220217/policy/modules/services/rasdaemon.if
===================================================================
--- /dev/null
+++ refpolicy-2.20220217/policy/modules/services/rasdaemon.if
@@ -0,0 +1 @@
+## <summary></summary>
Index: refpolicy-2.20220217/policy/modules/services/rasdaemon.te
===================================================================
--- /dev/null
+++ refpolicy-2.20220217/policy/modules/services/rasdaemon.te
@@ -0,0 +1,50 @@
+policy_module(rasdaemon, 1.0.0)
+
+# rasdaemon is a RAS (Reliability, Availability and Serviceability) logging
+# tool.  It currently records memory errors, using the EDAC tracing events.
+# EDAC are drivers in the Linux kernel that handle detection of ECC errors
+# from memory controllers for most chipsets on x86 and ARM architectures.
+#
+# https://git.infradead.org/users/mchehab/rasdaemon.git
+
+########################################
+#
+# Declarations
+#
+
+type rasdaemon_t;
+type rasdaemon_exec_t;
+init_daemon_domain(rasdaemon_t, rasdaemon_exec_t)
+
+type rasdaemon_var_t;
+files_type(rasdaemon_var_t)
+
+########################################
+#
+# Local policy
+#
+
+allow rasdaemon_t self:unix_dgram_socket create_socket_perms;
+
+# confidentiality for tracefs and integrity for debugfs
+allow rasdaemon_t self:lockdown { confidentiality integrity };
+
+allow rasdaemon_t rasdaemon_var_t:dir manage_dir_perms;
+allow rasdaemon_t rasdaemon_var_t:file manage_file_perms;
+
+kernel_read_debugfs(rasdaemon_t)
+kernel_read_system_state(rasdaemon_t)
+kernel_read_vm_overcommit_sysctl(rasdaemon_t)
+kernel_search_fs_sysctls(rasdaemon_t)
+
+dev_list_sysfs(rasdaemon_t)
+dev_read_urand(rasdaemon_t)
+
+files_read_etc_symlinks(rasdaemon_t)
+files_search_var_lib(rasdaemon_t)
+fs_write_tracefs_files(rasdaemon_t)
+fs_create_tracefs_dirs(rasdaemon_t)
+
+logging_send_syslog_msg(rasdaemon_t)
+miscfiles_read_localization(rasdaemon_t)
+