156 lines
4.6 KiB
Diff
156 lines
4.6 KiB
Diff
From a65d7a6e589268afc80c871450423c82aeab530a Mon Sep 17 00:00:00 2001
|
|
From: Nikola Knazekova <nknazeko@redhat.com>
|
|
Date: Thu, 3 Nov 2022 11:33:59 +0100
|
|
Subject: [PATCH] Add watch_sb interfaces
|
|
|
|
Add interafaces that allow watch_sb user temporary directories,
|
|
tmpfs directories, boot and root directories.
|
|
Create watch_sb_dirs_pattern and watch_sb_dir_perms
|
|
---
|
|
policy/modules/kernel/files.if | 36 +++++++++++++++++++++++++++++
|
|
policy/modules/kernel/filesystem.if | 18 +++++++++++++++
|
|
policy/modules/system/userdomain.if | 18 +++++++++++++++
|
|
policy/support/file_patterns.spt | 4 ++++
|
|
policy/support/obj_perm_sets.spt | 1 +
|
|
5 files changed, 77 insertions(+)
|
|
|
|
diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
|
|
index 046db519bb..eb9e6e032c 100644
|
|
--- a/policy/modules/kernel/files.if
|
|
+++ b/policy/modules/kernel/files.if
|
|
@@ -2560,6 +2560,24 @@ interface(`files_write_root_dirs',`
|
|
allow $1 root_t:dir write;
|
|
')
|
|
|
|
+########################################
|
|
+## <summary>
|
|
+## Watch_sb root directories.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`files_watch_sb_root_dirs', `
|
|
+ gen_require(`
|
|
+ type root_t;
|
|
+ ')
|
|
+
|
|
+ watch_sb_dirs_pattern($1, root_t, root_t)
|
|
+')
|
|
+
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to write to / dirs.
|
|
@@ -3089,6 +3107,24 @@ interface(`files_watch_boot_dirs',`
|
|
allow $1 boot_t:dir watch_dir_perms;
|
|
')
|
|
|
|
+########################################
|
|
+## <summary>
|
|
+## Watch_sb boot directories.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`files_watch_sb_boot_dirs', `
|
|
+ gen_require(`
|
|
+ type boot_t;
|
|
+ ')
|
|
+
|
|
+ watch_sb_dirs_pattern($1, boot_t, boot_t)
|
|
+')
|
|
+
|
|
########################################
|
|
## <summary>
|
|
## Watch_mount directories in /boot.
|
|
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
|
|
index bb2f077f6d..d7645a534f 100644
|
|
--- a/policy/modules/kernel/filesystem.if
|
|
+++ b/policy/modules/kernel/filesystem.if
|
|
@@ -5400,6 +5400,24 @@ interface(`fs_mounton_tmpfs', `
|
|
allow $1 tmpfs_t:dir mounton;
|
|
')
|
|
|
|
+########################################
|
|
+## <summary>
|
|
+## Watch_sb tmpfs directories.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`fs_watch_sb_tmpfs', `
|
|
+ gen_require(`
|
|
+ type tmpfs_t;
|
|
+ ')
|
|
+
|
|
+ watch_sb_dirs_pattern($1, tmpfs_t, tmpfs_t)
|
|
+')
|
|
+
|
|
########################################
|
|
## <summary>
|
|
## Get the attributes of a tmpfs
|
|
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
|
index e8817429b2..62bc19c654 100644
|
|
--- a/policy/modules/system/userdomain.if
|
|
+++ b/policy/modules/system/userdomain.if
|
|
@@ -347,6 +347,24 @@ interface(`userdom_watch_tmp_dirs',`
|
|
watch_dirs_pattern($1, user_tmp_t, user_tmp_t)
|
|
')
|
|
|
|
+#######################################
|
|
+## <summary>
|
|
+## Watch_sb user temporary directories
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`userdom_watch_sb_tmp_dirs',`
|
|
+ gen_require(`
|
|
+ type user_tmp_t;
|
|
+ ')
|
|
+
|
|
+ watch_sb_dirs_pattern($1, user_tmp_t, user_tmp_t)
|
|
+')
|
|
+
|
|
#######################################
|
|
## <summary>
|
|
## Watch_mount user temporary directories
|
|
diff --git a/policy/support/file_patterns.spt b/policy/support/file_patterns.spt
|
|
index c832c0dab0..57581a8573 100644
|
|
--- a/policy/support/file_patterns.spt
|
|
+++ b/policy/support/file_patterns.spt
|
|
@@ -88,6 +88,10 @@ define(`watch_reads_dirs_pattern',`
|
|
allow $1 $2:dir search_dir_perms;
|
|
allow $1 $3:dir watch_reads_dir_perms;
|
|
')
|
|
+define(`watch_sb_dirs_pattern',`
|
|
+ allow $1 $2:dir search_dir_perms;
|
|
+ allow $1 $3:dir watch_sb_dir_perms;
|
|
+')
|
|
define(`watch_with_perm_dirs_pattern',`
|
|
allow $1 $2:dir search_dir_perms;
|
|
allow $1 $3:dir watch_with_perm_dir_perms;
|
|
diff --git a/policy/support/obj_perm_sets.spt b/policy/support/obj_perm_sets.spt
|
|
index 85283eb1e5..c76a77fac9 100644
|
|
--- a/policy/support/obj_perm_sets.spt
|
|
+++ b/policy/support/obj_perm_sets.spt
|
|
@@ -149,6 +149,7 @@ define(`relabel_dir_perms',`{ getattr relabelfrom relabelto }')
|
|
define(`watch_dir_perms',`{ getattr watch }')
|
|
define(`watch_mount_dir_perms',`{ getattr watch_mount }')
|
|
define(`watch_reads_dir_perms',`{ getattr watch_reads }')
|
|
+define(`watch_sb_dir_perms',`{ getattr watch_sb }')
|
|
define(`watch_with_perm_dir_perms',`{ getattr watch_with_perm }')
|
|
|
|
#
|