From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <gentoo-commits+bounces-630827-garchives=archives.gentoo.org@lists.gentoo.org> Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id B76A41381F3 for <garchives@archives.gentoo.org>; Fri, 27 Sep 2013 13:27:35 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 780ABE0F1B; Fri, 27 Sep 2013 13:27:30 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id C3A98E0EF1 for <gentoo-commits@lists.gentoo.org>; Fri, 27 Sep 2013 13:27:29 +0000 (UTC) Received: from hornbill.gentoo.org (hornbill.gentoo.org [94.100.119.163]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id B0DE933EE38 for <gentoo-commits@lists.gentoo.org>; Fri, 27 Sep 2013 13:27:28 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by hornbill.gentoo.org (Postfix) with ESMTP id F2D77E546B for <gentoo-commits@lists.gentoo.org>; Fri, 27 Sep 2013 13:27:26 +0000 (UTC) From: "Sven Vermeulen" <swift@gentoo.org> To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Sven Vermeulen" <swift@gentoo.org> Message-ID: <1380288177.5a90d99532c94d6a1978b7f9fbb1704d723b87b5.swift@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/kernel/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/kernel/terminal.fc policy/modules/kernel/terminal.if policy/modules/kernel/terminal.te X-VCS-Directories: policy/modules/kernel/ X-VCS-Committer: swift X-VCS-Committer-Name: Sven Vermeulen X-VCS-Revision: 5a90d99532c94d6a1978b7f9fbb1704d723b87b5 X-VCS-Branch: master Date: Fri, 27 Sep 2013 13:27:26 +0000 (UTC) Precedence: bulk List-Post: <mailto:gentoo-commits@lists.gentoo.org> List-Help: <mailto:gentoo-commits+help@lists.gentoo.org> List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org> List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org> List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org> X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: fc7f42db-c601-4ad5-bcca-3988bd5d7cbb X-Archives-Hash: d35eb781b9195d9cf92f40fe12719f53 commit: 5a90d99532c94d6a1978b7f9fbb1704d723b87b5 Author: Dominick Grift <dominick.grift <AT> gmail <DOT> com> AuthorDate: Tue Sep 24 13:39:56 2013 +0000 Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> CommitDate: Fri Sep 27 13:22:57 2013 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=5a90d995 Initial virtio console device Also known as 'vmchannel', a transport mechanism is needed for communication between the host userspace and guest userspace for achieving things like making clipboard copy/paste work seamlessly across the host and guest, locking the guest screen in case the vnc session to the guest is closed and so on. This can be used in offline cases as well, for example with libguestfs to probe which file systems the guest uses, the apps installed, etc. Virtio-serial is just the transport protocol that will enable such applications to be written. It has two parts: (a) device emulation in qemu that presents a virtio-pci device to the guest and (b) a guest driver that presents a char device interface to userspace applications. Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com> --- policy/modules/kernel/terminal.fc | 1 + policy/modules/kernel/terminal.if | 19 +++++++++++++++++++ policy/modules/kernel/terminal.te | 4 ++++ 3 files changed, 24 insertions(+) diff --git a/policy/modules/kernel/terminal.fc b/policy/modules/kernel/terminal.fc index 7d45d15..0ea25b6 100644 --- a/policy/modules/kernel/terminal.fc +++ b/policy/modules/kernel/terminal.fc @@ -19,6 +19,7 @@ /dev/slamr[0-9]+ -c gen_context(system_u:object_r:tty_device_t,s0) /dev/tty -c gen_context(system_u:object_r:devtty_t,s0) /dev/ttySG.* -c gen_context(system_u:object_r:tty_device_t,s0) +/dev/vport[0-9]p[0-9]+ -c gen_context(system_u:object_r:virtio_device_t,s0) /dev/xvc[^/]* -c gen_context(system_u:object_r:tty_device_t,s0) /dev/pty/.* -c gen_context(system_u:object_r:bsdpty_device_t,s0) diff --git a/policy/modules/kernel/terminal.if b/policy/modules/kernel/terminal.if index 771bce1..cbb729b 100644 --- a/policy/modules/kernel/terminal.if +++ b/policy/modules/kernel/terminal.if @@ -1512,3 +1512,22 @@ interface(`term_dontaudit_use_all_user_ttys',` refpolicywarn(`$0() is deprecated, use term_dontaudit_use_all_ttys() instead.') term_dontaudit_use_all_ttys($1) ') + +##################################### +## <summary> +## Read from and write virtio console. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`term_use_virtio_console',` + gen_require(` + type virtio_device_t; + ') + + dev_list_all_dev_nodes($1) + allow $1 virtio_device_t:chr_file rw_term_perms; +') diff --git a/policy/modules/kernel/terminal.te b/policy/modules/kernel/terminal.te index 224e500..a4c9998 100644 --- a/policy/modules/kernel/terminal.te +++ b/policy/modules/kernel/terminal.te @@ -56,3 +56,7 @@ dev_node(tty_device_t) # type usbtty_device_t, serial_device; dev_node(usbtty_device_t) + +type virtio_device_t, serial_device; +dev_node(virtio_device_t) +