From: "Jason Zaman" <perfinion@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/services/
Date: Tue, 15 Jul 2025 07:54:15 +0000 (UTC) [thread overview]
Message-ID: <1752565943.7347bc35902aadb392283f6cca3449564162a4ba.perfinion@gentoo> (raw)
commit: 7347bc35902aadb392283f6cca3449564162a4ba
Author: Russell Coker <russell <AT> coker <DOT> com <DOT> au>
AuthorDate: Wed Jun 18 14:39:42 2025 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Tue Jul 15 07:52:23 2025 +0000
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7347bc35
device (#939)
* device related patches
Signed-off-by: Russell Coker <russell <AT> coker.com.au>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/services/devicekit.te | 7 ++++++-
policy/modules/system/mount.if | 18 ++++++++++++++++++
policy/modules/system/udev.te | 1 +
3 files changed, 25 insertions(+), 1 deletion(-)
diff --git a/policy/modules/services/devicekit.te b/policy/modules/services/devicekit.te
index 1c86230c5..abc2b0b86 100644
--- a/policy/modules/services/devicekit.te
+++ b/policy/modules/services/devicekit.te
@@ -102,6 +102,7 @@ dev_getattr_mtrr_dev(devicekit_disk_t)
dev_getattr_usbfs_dirs(devicekit_disk_t)
dev_read_rand(devicekit_disk_t)
dev_read_urand(devicekit_disk_t)
+dev_rw_lvm_control(devicekit_disk_t)
dev_rw_sysfs(devicekit_disk_t)
domain_getattr_all_pipes(devicekit_disk_t)
@@ -116,6 +117,7 @@ files_getattr_all_files(devicekit_disk_t)
files_getattr_all_pipes(devicekit_disk_t)
files_manage_boot_dirs(devicekit_disk_t)
files_manage_mnt_dirs(devicekit_disk_t)
+files_mounton_mnt(devicekit_disk_t)
files_read_etc_runtime_files(devicekit_disk_t)
files_read_usr_files(devicekit_disk_t)
files_watch_etc_dirs(devicekit_disk_t)
@@ -131,6 +133,9 @@ mls_file_read_all_levels(devicekit_disk_t)
mls_file_write_to_clearance(devicekit_disk_t)
mount_rw_runtime_files(devicekit_disk_t)
+mount_watch_runtime_dirs(devicekit_disk_t)
+mount_watch_runtime_files(devicekit_disk_t)
+mount_watch_runtime_files_reads(devicekit_disk_t)
storage_raw_read_fixed_disk(devicekit_disk_t)
storage_raw_write_fixed_disk(devicekit_disk_t)
@@ -204,7 +209,7 @@ optional_policy(`
allow devicekit_power_t self:capability { dac_override net_admin sys_admin sys_nice sys_ptrace sys_tty_config };
allow devicekit_power_t self:capability2 wake_alarm;
-allow devicekit_power_t self:process { getsched signal_perms };
+allow devicekit_power_t self:process { getsched setsched signal_perms };
allow devicekit_power_t self:fifo_file rw_fifo_file_perms;
allow devicekit_power_t self:unix_dgram_socket create_socket_perms;
allow devicekit_power_t self:unix_stream_socket create_socket_perms;
diff --git a/policy/modules/system/mount.if b/policy/modules/system/mount.if
index d425a5d76..4a084d56c 100644
--- a/policy/modules/system/mount.if
+++ b/policy/modules/system/mount.if
@@ -273,6 +273,24 @@ interface(`mount_watch_reads_runtime_files',`
allow $1 mount_runtime_t:file watch_reads;
')
+########################################
+## <summary>
+## Watch mount runtime files reads.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`mount_watch_runtime_files_reads',`
+ gen_require(`
+ type mount_runtime_t;
+ ')
+
+ allow $1 mount_runtime_t:file watch_reads;
+')
+
########################################
## <summary>
## Getattr on mount_runtime_t files
diff --git a/policy/modules/system/udev.te b/policy/modules/system/udev.te
index bf6b8b53e..3e956d6e8 100644
--- a/policy/modules/system/udev.te
+++ b/policy/modules/system/udev.te
@@ -109,6 +109,7 @@ kernel_read_fs_sysctls(udev_t)
#https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235182
kernel_rw_net_sysctls(udev_t)
kernel_read_network_state(udev_t)
+kernel_read_psi(udev_t)
kernel_read_software_raid_state(udev_t)
kernel_dontaudit_search_unlabeled(udev_t)
next reply other threads:[~2025-07-15 7:54 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-15 7:54 Jason Zaman [this message]
-- strict thread matches above, loose matches on Subject: below --
2025-07-15 8:05 [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/system/, policy/modules/services/ Jason Zaman
2025-07-15 7:54 Jason Zaman
2024-12-15 0:30 Jason Zaman
2024-09-22 0:03 Jason Zaman
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2024-05-14 19:42 Kenton Groombridge
2023-10-06 16:44 Kenton Groombridge
2023-10-06 16:44 Kenton Groombridge
2022-11-02 14:42 Kenton Groombridge
2022-04-09 19:28 Jason Zaman
2022-02-27 2:52 Jason Zaman
2022-02-07 2:14 Jason Zaman
2022-01-30 1:22 Jason Zaman
2021-11-11 21:27 Jason Zaman
2021-09-05 16:00 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-07 3:20 Jason Zaman
2018-12-09 11:48 Jason Zaman
2018-11-11 23:29 Jason Zaman
2018-11-11 23:29 Jason Zaman
2017-01-01 16:36 Jason Zaman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1752565943.7347bc35902aadb392283f6cca3449564162a4ba.perfinion@gentoo \
--to=perfinion@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox