* [PATCH 0/1] selinux-testsuite: Add watch_sb and watch_mount checks
@ 2020-01-30 19:07 Richard Haines
2020-01-30 19:07 ` [PATCH 1/1] " Richard Haines
0 siblings, 1 reply; 4+ messages in thread
From: Richard Haines @ 2020-01-30 19:07 UTC (permalink / raw)
To: selinux; +Cc: Richard Haines
To test fanotify fs watch perms on 5.4+ (will also include tests/notify):
1) Extract the base module (base.cil):
semodule -c -E base
2) Edit the following definitions in base.cil to add watch permissions:
(common file (ioctl read write ....))
Add:
watch watch_mount watch_sb watch_with_perm watch_reads
(class filesystem (mount remount ....))
Add:
watch
3) Insert modified base module (inserts with default priority 400):
semodule -i base.cil
4) Backup, then edit the following definitions in:
/usr/share/selinux/devel/include/support/all_perms.spt
define(`all_file_perms',`{ ioctl read write ....
Add:
watch watch_mount watch_sb watch_with_perm watch_reads
define(`all_dir_perms',`{ ioctl read write ....
Add:
watch watch_mount watch_sb watch_with_perm watch_reads
define(`all_filesystem_perms',`{ mount remount ....
Add:
watch
5) 'make test' can now be run. tests/filesystem should run 81 tests, and
tests/fs_filesystem should run 79 tests. However one test will fail on
current kernels (fix in 5.7) with fs_filesystem because:
'Failed as kernel 5.x without "selinux: fix regression introduced by
move_mount(2) syscall" patch'
NOTE: Do NOT leave the new base.cil active after tests, as the system may
not reboot if in enforcing mode, as various watch permissions will be denied.
Revert to the original (priority 100) as follows:
semodule -r base
make clean
make -C policy unload
Finally restore the original:
/usr/share/selinux/devel/include/support/all_perms.spt
Richard Haines (1):
selinux-testsuite: Add watch_sb and watch_mount checks
policy/Makefile | 3 ++
policy/test_filesystem.te | 15 -------
policy/test_filesystem_notify.te | 60 ++++++++++++++++++++++++++
tests/filesystem/Filesystem.pm | 6 +--
tests/filesystem/fanotify_fs.c | 18 ++++++--
tests/filesystem/test | 74 ++++++++++++++++++++++++++++++--
tests/fs_filesystem/test | 74 ++++++++++++++++++++++++++++++--
7 files changed, 221 insertions(+), 29 deletions(-)
create mode 100644 policy/test_filesystem_notify.te
--
2.24.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 1/1] selinux-testsuite: Add watch_sb and watch_mount checks
2020-01-30 19:07 [PATCH 0/1] selinux-testsuite: Add watch_sb and watch_mount checks Richard Haines
@ 2020-01-30 19:07 ` Richard Haines
2020-02-04 13:44 ` Stephen Smalley
0 siblings, 1 reply; 4+ messages in thread
From: Richard Haines @ 2020-01-30 19:07 UTC (permalink / raw)
To: selinux; +Cc: Richard Haines
Test watch_sb and watch_mount permissions.
The policy is contained in test_filesystem_notify.te as it can then be
built if the policy supports the permissions.
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
---
policy/Makefile | 3 ++
policy/test_filesystem.te | 15 -------
policy/test_filesystem_notify.te | 60 ++++++++++++++++++++++++++
tests/filesystem/Filesystem.pm | 6 +--
tests/filesystem/fanotify_fs.c | 18 ++++++--
tests/filesystem/test | 74 ++++++++++++++++++++++++++++++--
tests/fs_filesystem/test | 74 ++++++++++++++++++++++++++++++--
7 files changed, 221 insertions(+), 29 deletions(-)
create mode 100644 policy/test_filesystem_notify.te
diff --git a/policy/Makefile b/policy/Makefile
index 33378b5..cf8d431 100644
--- a/policy/Makefile
+++ b/policy/Makefile
@@ -118,6 +118,9 @@ ifeq ($(shell grep -q filesystem $(POLDEV)/include/support/all_perms.spt && echo
TARGETS += test_filesystem.te
ifeq ($(shell [ $(MOD_POL_VERS) -ge 11 -a $(POL_VERS) -ge 25 ] && echo true),true)
TARGETS += test_filesystem_name_trans.te
+ifeq ($(shell grep -q all_file_perms.*watch $(POLDEV)/include/support/all_perms.spt && echo true),true)
+TARGETS+= test_filesystem_notify.te
+endif
endif
endif
diff --git a/policy/test_filesystem.te b/policy/test_filesystem.te
index 4ff493a..09f9d4a 100644
--- a/policy/test_filesystem.te
+++ b/policy/test_filesystem.te
@@ -292,21 +292,6 @@ dontaudit unconfined_t test_filesystem_filecon_t:file { getattr read };
allow test_filesystem_inode_setxattr_no_associate_t unconfined_t:dir { add_name write };
allow test_filesystem_inode_setxattr_no_associate_t unconfined_t:file { create relabelfrom relabelto };
-#################### Deny filesystem { watch } ######################
-# hooks.c selinux_path_notify() FILESYSTEM__WATCH
-type test_filesystem_no_watch_t;
-domain_type(test_filesystem_no_watch_t)
-unconfined_runs_test(test_filesystem_no_watch_t)
-typeattribute test_filesystem_no_watch_t testdomain;
-typeattribute test_filesystem_no_watch_t filesystemdomain;
-
-allow test_filesystem_no_watch_t self:capability { sys_admin };
-allow test_filesystem_no_watch_t self:filesystem { associate relabelto mount unmount relabelfrom };
-allow test_filesystem_no_watch_t test_file_t:dir { mounton write remove_name rmdir };
-fs_mount_all_fs(test_filesystem_no_watch_t)
-fs_relabelfrom_all_fs(test_filesystem_no_watch_t)
-fs_associate(test_filesystem_no_watch_t)
-
################# Test process { setfscreate } #############
type test_setfscreatecon_t;
domain_type(test_setfscreatecon_t)
diff --git a/policy/test_filesystem_notify.te b/policy/test_filesystem_notify.te
new file mode 100644
index 0000000..3e8a246
--- /dev/null
+++ b/policy/test_filesystem_notify.te
@@ -0,0 +1,60 @@
+#
+######### Test filesystem fanotify(7) policy module ##########
+#
+
+################# Test all functions ##########################
+# For fanotify tests
+allow test_filesystem_t self:filesystem { watch };
+# Until 'fs_watch_all_fs(test_filesystem_t)' in Policy use:
+gen_require(`
+ type fs_t;
+')
+allow test_filesystem_t fs_t:filesystem { watch };
+allow test_filesystem_t test_filesystem_file_t:dir { watch_sb watch_mount };
+
+#################### Deny filesystem { watch } ######################
+# hooks.c selinux_path_notify() FILESYSTEM__WATCH
+type test_filesystem_no_watch_t;
+domain_type(test_filesystem_no_watch_t)
+unconfined_runs_test(test_filesystem_no_watch_t)
+typeattribute test_filesystem_no_watch_t testdomain;
+typeattribute test_filesystem_no_watch_t filesystemdomain;
+
+allow test_filesystem_no_watch_t self:capability { sys_admin };
+allow test_filesystem_no_watch_t self:filesystem { associate relabelto mount unmount relabelfrom };
+allow test_filesystem_no_watch_t test_file_t:dir { mounton write remove_name rmdir };
+fs_mount_all_fs(test_filesystem_no_watch_t)
+fs_relabelfrom_all_fs(test_filesystem_no_watch_t)
+fs_associate(test_filesystem_no_watch_t)
+
+#################### Deny file { watch_sb } ######################
+# hooks.c selinux_path_notify() FILE__WATCH_SB
+type test_filesystem_no_watch_sb_t;
+domain_type(test_filesystem_no_watch_sb_t)
+unconfined_runs_test(test_filesystem_no_watch_sb_t)
+typeattribute test_filesystem_no_watch_sb_t testdomain;
+typeattribute test_filesystem_no_watch_sb_t filesystemdomain;
+
+allow test_filesystem_no_watch_sb_t self:capability { sys_admin };
+allow test_filesystem_no_watch_sb_t self:filesystem { watch associate relabelto mount unmount relabelfrom };
+allow test_filesystem_no_watch_sb_t test_file_t:dir { mounton write remove_name rmdir };
+
+fs_mount_all_fs(test_filesystem_no_watch_sb_t)
+fs_relabelfrom_all_fs(test_filesystem_no_watch_sb_t)
+fs_associate(test_filesystem_no_watch_sb_t)
+
+#################### Deny file { watch_mount } ######################
+# hooks.c selinux_path_notify() FILE__WATCH_MOUNT
+type test_filesystem_no_watch_mount_t;
+domain_type(test_filesystem_no_watch_mount_t)
+unconfined_runs_test(test_filesystem_no_watch_mount_t)
+typeattribute test_filesystem_no_watch_mount_t testdomain;
+typeattribute test_filesystem_no_watch_mount_t filesystemdomain;
+
+allow test_filesystem_no_watch_mount_t self:capability { sys_admin };
+allow test_filesystem_no_watch_mount_t self:filesystem { watch associate relabelto mount unmount relabelfrom };
+allow test_filesystem_no_watch_mount_t test_file_t:dir { mounton write remove_name rmdir };
+
+fs_mount_all_fs(test_filesystem_no_watch_mount_t)
+fs_relabelfrom_all_fs(test_filesystem_no_watch_mount_t)
+fs_associate(test_filesystem_no_watch_mount_t)
diff --git a/tests/filesystem/Filesystem.pm b/tests/filesystem/Filesystem.pm
index 3d4194d..a08570a 100644
--- a/tests/filesystem/Filesystem.pm
+++ b/tests/filesystem/Filesystem.pm
@@ -8,16 +8,16 @@ sub check_config {
$tst_count = 0;
- # From kernel 5.5 support for fanotify(7) with filesystem { watch }
+ # From kernel 5.4 support for fanotify(7) LSM hooks
$kvercur = `uname -r`;
chomp($kvercur);
- $kverminstream = "5.5";
+ $kverminstream = "5.4";
$watch = 0;
$result = `$base/../kvercmp $kvercur $kverminstream`;
if ( $result > 0 && -e $fanotify_fs ) {
$watch = 1;
- $tst_count += 4;
+ $tst_count += 11;
}
$name_trans = 0;
diff --git a/tests/filesystem/fanotify_fs.c b/tests/filesystem/fanotify_fs.c
index c525d69..2a8f90e 100644
--- a/tests/filesystem/fanotify_fs.c
+++ b/tests/filesystem/fanotify_fs.c
@@ -11,29 +11,38 @@
#ifndef FAN_MARK_FILESYSTEM
#define FAN_MARK_FILESYSTEM 0x00000100
#endif
+#ifndef FAN_MARK_MOUNT
+#define FAN_MARK_MOUNT 0x00000010
+#endif
static void print_usage(char *progname)
{
fprintf(stderr,
- "usage: %s -t path [-v]\n"
+ "usage: %s -t path [-m] [-v]\n"
"Where:\n\t"
"-t Target mount point to mark\n\t"
+ "-m Set flag to FAN_MARK_MOUNT, default is FAN_MARK_FILESYSTEM\n\t"
"-v Print information.\n", progname);
exit(-1);
}
int main(int argc, char *argv[])
{
- int mask = FAN_OPEN, flags = FAN_MARK_ADD | FAN_MARK_FILESYSTEM;
+ int mask = FAN_OPEN, flags;
int fd, result, opt, save_err;
char *context, *tgt = NULL;
bool verbose = false;
- while ((opt = getopt(argc, argv, "t:v")) != -1) {
+ flags = 0;
+
+ while ((opt = getopt(argc, argv, "t:mv")) != -1) {
switch (opt) {
case 't':
tgt = optarg;
break;
+ case 'm':
+ flags = FAN_MARK_ADD | FAN_MARK_MOUNT;
+ break;
case 'v':
verbose = true;
break;
@@ -42,6 +51,9 @@ int main(int argc, char *argv[])
}
}
+ if (!flags)
+ flags = FAN_MARK_ADD | FAN_MARK_FILESYSTEM;
+
if (!tgt)
print_usage(argv[0]);
diff --git a/tests/filesystem/test b/tests/filesystem/test
index 5bdd124..78faf72 100755
--- a/tests/filesystem/test
+++ b/tests/filesystem/test
@@ -148,11 +148,17 @@ if ($test_name_trans) {
}
if ($test_watch) {
- print "fanotify(7) test\n";
+ print "fanotify(7) test - FAN_MARK_FILESYSTEM\n";
$result = system(
"runcon -t test_filesystem_t $basedir/fanotify_fs $v -t $basedir/mntpoint/mp1"
);
ok( $result eq 0 );
+
+ print "fanotify(7) test - FAN_MARK_MOUNT\n";
+ $result = system(
+"runcon -t test_filesystem_t $basedir/fanotify_fs $v -m -t $basedir/mntpoint/mp1"
+ );
+ ok( $result eq 0 );
}
print "Unmount filesystem from $basedir/mntpoint/mp1\n";
@@ -556,9 +562,9 @@ ok( $result eq 0 );
print "Removing: $dev $basedir/mntpoint $basedir/fstest\n";
cleanup1( $basedir, $dev );
-############### Deny filesystem { watch } ##########################
-# hooks.c selinux_path_notify() FILESYSTEM__WATCH
if ($test_watch) {
+ ############### Deny filesystem { watch } ##########################
+ # hooks.c selinux_path_notify() FILESYSTEM__WATCH
mk_mntpoint_1($private_path);
( $dev, $device_count ) = get_loop_dev( \@device_list, $device_count );
make_fs( $fs_type, $dev, $basedir );
@@ -571,7 +577,7 @@ if ($test_watch) {
);
ok( $result eq 0 );
- print "test_fanotify\n";
+ print "fanotify(7) test - FAN_MARK_FILESYSTEM\n";
$result = system(
"runcon -t test_filesystem_no_watch_t $basedir/fanotify_fs $v -t $basedir/mntpoint/mp1 2>&1"
);
@@ -585,6 +591,66 @@ if ($test_watch) {
print "Removing: $dev $basedir/mntpoint $basedir/fstest\n";
cleanup1( $basedir, $dev );
+
+ ############### Deny file { watch_sb } ##########################
+ # hooks.c selinux_path_notify() FILE__WATCH_SB
+ mk_mntpoint_1($private_path);
+ ( $dev, $device_count ) = get_loop_dev( \@device_list, $device_count );
+ make_fs( $fs_type, $dev, $basedir );
+ $opts_no_watch_sb =
+ "context=system_u:object_r:test_filesystem_no_watch_sb_t:s0";
+
+ print "Mount $fs_type filesystem on $basedir/mntpoint/mp1\n";
+ print "Using mount options:\n\t$opts_no_watch_sb\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_sb_t $basedir/mount -s $dev -t $basedir/mntpoint/mp1 -f $fs_type -o $opts_no_watch_sb $v"
+ );
+ ok( $result eq 0 );
+
+ print "fanotify(7) test - FAN_MARK_FILESYSTEM\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_sb_t $basedir/fanotify_fs $v -t $basedir/mntpoint/mp1 2>&1"
+ );
+ ok( $result >> 8 eq 13 );
+
+ print "Unmount filesystem from $basedir/mntpoint/mp1\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_sb_t $basedir/umount -t $basedir/mntpoint/mp1 $v"
+ );
+ ok( $result eq 0 );
+
+ print "Removing: $dev $basedir/mntpoint $basedir/fstest\n";
+ cleanup1( $basedir, $dev );
+
+ ############### Deny file { watch_mount } ##########################
+ # hooks.c selinux_path_notify() FILE__WATCH_MOUNT
+ mk_mntpoint_1($private_path);
+ ( $dev, $device_count ) = get_loop_dev( \@device_list, $device_count );
+ make_fs( $fs_type, $dev, $basedir );
+ $opts_no_watch_mount =
+ "context=system_u:object_r:test_filesystem_no_watch_mount_t:s0";
+
+ print "Mount $fs_type filesystem on $basedir/mntpoint/mp1\n";
+ print "Using mount options:\n\t$opts_no_watch_mount\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_mount_t $basedir/mount -s $dev -t $basedir/mntpoint/mp1 -f $fs_type -o $opts_no_watch_mount $v"
+ );
+ ok( $result eq 0 );
+
+ print "fanotify(7) test - FAN_MARK_MOUNT\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_mount_t $basedir/fanotify_fs $v -m -t $basedir/mntpoint/mp1 2>&1"
+ );
+ ok( $result >> 8 eq 13 );
+
+ print "Unmount filesystem from $basedir/mntpoint/mp1\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_mount_t $basedir/umount -t $basedir/mntpoint/mp1 $v"
+ );
+ ok( $result eq 0 );
+
+ print "Removing: $dev $basedir/mntpoint $basedir/fstest\n";
+ cleanup1( $basedir, $dev );
}
##########################################################################
diff --git a/tests/fs_filesystem/test b/tests/fs_filesystem/test
index 4ff352d..0bf9631 100755
--- a/tests/fs_filesystem/test
+++ b/tests/fs_filesystem/test
@@ -118,11 +118,17 @@ if ($test_name_trans) {
}
if ($test_watch) {
- print "fanotify(7) test\n";
+ print "fanotify(7) test - FAN_MARK_FILESYSTEM\n";
$result = system(
"runcon -t test_filesystem_t $filesystem_dir/fanotify_fs $v -t $basedir/mntpoint/mp1"
);
ok( $result eq 0 );
+
+ print "fanotify(7) test - FAN_MARK_MOUNT\n";
+ $result = system(
+"runcon -t test_filesystem_t $filesystem_dir/fanotify_fs $v -m -t $basedir/mntpoint/mp1"
+ );
+ ok( $result eq 0 );
}
print "Unmount filesystem from $basedir/mntpoint/mp1\n";
@@ -564,9 +570,9 @@ ok( $result eq 0 );
print "Removing: $dev $basedir/mntpoint $basedir/fstest\n";
cleanup1( $basedir, $dev );
-############### Deny filesystem { watch } ##########################
-# hooks.c selinux_path_notify() FILESYSTEM__WATCH
if ($test_watch) {
+ ############### Deny filesystem { watch } ##########################
+ # hooks.c selinux_path_notify() FILESYSTEM__WATCH
mk_mntpoint_1("$basedir/mntpoint");
( $dev, $device_count ) = get_loop_dev( \@device_list, $device_count );
make_fs( $fs_type, $dev, $basedir );
@@ -579,7 +585,7 @@ if ($test_watch) {
);
ok( $result eq 0 );
- print "test_fanotify\n";
+ print "fanotify(7) test - FAN_MARK_FILESYSTEM\n";
$result = system(
"runcon -t test_filesystem_no_watch_t $filesystem_dir/fanotify_fs $v -t $basedir/mntpoint/mp1 2>&1"
);
@@ -593,6 +599,66 @@ if ($test_watch) {
print "Removing: $dev $basedir/mntpoint $basedir/fstest\n";
cleanup1( $basedir, $dev );
+
+ ############### Deny file { watch_sb } ##########################
+ # hooks.c selinux_path_notify() FILE__WATCH_SB
+ mk_mntpoint_1("$basedir/mntpoint");
+ ( $dev, $device_count ) = get_loop_dev( \@device_list, $device_count );
+ make_fs( $fs_type, $dev, $basedir );
+ $opts_no_watch_sb =
+ "context=system_u:object_r:test_filesystem_no_watch_sb_t:s0";
+
+ print "Mount $fs_type filesystem on $basedir/mntpoint/mp1\n";
+ print "Using mount options:\n\t$opts_no_watch_sb\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_sb_t $basedir/fsmount -s $dev -t $basedir/mntpoint/mp1 -f $fs_type -o $opts_no_watch_sb $v"
+ );
+ ok( $result eq 0 );
+
+ print "fanotify(7) test - FAN_MARK_FILESYSTEM\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_sb_t $filesystem_dir/fanotify_fs $v -t $basedir/mntpoint/mp1 2>&1"
+ );
+ ok( $result >> 8 eq 13 );
+
+ print "Unmount filesystem from $basedir/mntpoint/mp1\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_sb_t $filesystem_dir/umount -t $basedir/mntpoint/mp1 $v"
+ );
+ ok( $result eq 0 );
+
+ print "Removing: $dev $basedir/mntpoint $basedir/fstest\n";
+ cleanup1( $basedir, $dev );
+
+ ############### Deny file { watch_mount } ##########################
+ # hooks.c selinux_path_notify() FILE__WATCH_MOUNT
+ mk_mntpoint_1("$basedir/mntpoint");
+ ( $dev, $device_count ) = get_loop_dev( \@device_list, $device_count );
+ make_fs( $fs_type, $dev, $basedir );
+ $opts_no_watch_mount =
+ "context=system_u:object_r:test_filesystem_no_watch_mount_t:s0";
+
+ print "Mount $fs_type filesystem on $basedir/mntpoint/mp1\n";
+ print "Using mount options:\n\t$opts_no_watch_mount\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_mount_t $basedir/fsmount -s $dev -t $basedir/mntpoint/mp1 -f $fs_type -o $opts_no_watch_mount $v"
+ );
+ ok( $result eq 0 );
+
+ print "fanotify(7) test - FAN_MARK_MOUNT\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_mount_t $filesystem_dir/fanotify_fs $v -m -t $basedir/mntpoint/mp1 2>&1"
+ );
+ ok( $result >> 8 eq 13 );
+
+ print "Unmount filesystem from $basedir/mntpoint/mp1\n";
+ $result = system(
+"runcon -t test_filesystem_no_watch_mount_t $filesystem_dir/umount -t $basedir/mntpoint/mp1 $v"
+ );
+ ok( $result eq 0 );
+
+ print "Removing: $dev $basedir/mntpoint $basedir/fstest\n";
+ cleanup1( $basedir, $dev );
}
##########################################################################
--
2.24.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 1/1] selinux-testsuite: Add watch_sb and watch_mount checks
2020-01-30 19:07 ` [PATCH 1/1] " Richard Haines
@ 2020-02-04 13:44 ` Stephen Smalley
2020-02-06 15:49 ` Stephen Smalley
0 siblings, 1 reply; 4+ messages in thread
From: Stephen Smalley @ 2020-02-04 13:44 UTC (permalink / raw)
To: Richard Haines, selinux
On 1/30/20 2:07 PM, Richard Haines wrote:
> Test watch_sb and watch_mount permissions.
> The policy is contained in test_filesystem_notify.te as it can then be
> built if the policy supports the permissions.
>
> Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
Tested with and without the watch permissions defined in base.cil and
all_perms.spt; everything worked as expected.
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
> policy/Makefile | 3 ++
> policy/test_filesystem.te | 15 -------
> policy/test_filesystem_notify.te | 60 ++++++++++++++++++++++++++
> tests/filesystem/Filesystem.pm | 6 +--
> tests/filesystem/fanotify_fs.c | 18 ++++++--
> tests/filesystem/test | 74 ++++++++++++++++++++++++++++++--
> tests/fs_filesystem/test | 74 ++++++++++++++++++++++++++++++--
> 7 files changed, 221 insertions(+), 29 deletions(-)
> create mode 100644 policy/test_filesystem_notify.te
[...]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 1/1] selinux-testsuite: Add watch_sb and watch_mount checks
2020-02-04 13:44 ` Stephen Smalley
@ 2020-02-06 15:49 ` Stephen Smalley
0 siblings, 0 replies; 4+ messages in thread
From: Stephen Smalley @ 2020-02-06 15:49 UTC (permalink / raw)
To: Richard Haines, selinux
On 2/4/20 8:44 AM, Stephen Smalley wrote:
> On 1/30/20 2:07 PM, Richard Haines wrote:
>> Test watch_sb and watch_mount permissions.
>> The policy is contained in test_filesystem_notify.te as it can then be
>> built if the policy supports the permissions.
>>
>> Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
>
> Tested with and without the watch permissions defined in base.cil and
> all_perms.spt; everything worked as expected.
>
> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
>
>> ---
Applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-02-06 15:48 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-30 19:07 [PATCH 0/1] selinux-testsuite: Add watch_sb and watch_mount checks Richard Haines
2020-01-30 19:07 ` [PATCH 1/1] " Richard Haines
2020-02-04 13:44 ` Stephen Smalley
2020-02-06 15:49 ` Stephen Smalley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).