From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id B851C138CD0 for ; Thu, 2 Jul 2015 18:37:19 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 45FA2E084F; Thu, 2 Jul 2015 18:37:14 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id D8F25E084F for ; Thu, 2 Jul 2015 18:37:13 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 0BCE2340885 for ; Thu, 2 Jul 2015 18:37:13 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 960A9739 for ; Thu, 2 Jul 2015 18:37:11 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1435862199.5e553876568eeb34bd2611a377a9ce6fa8506494.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/qemu.fc policy/modules/contrib/qemu.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: 5e553876568eeb34bd2611a377a9ce6fa8506494 X-VCS-Branch: next Date: Thu, 2 Jul 2015 18:37:11 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 4b7f9b39-9425-40ba-bf84-e0c745ab2e02 X-Archives-Hash: d129b93a245c195891efc06754ba7e99 commit: 5e553876568eeb34bd2611a377a9ce6fa8506494 Author: Jason Zaman perfinion com> AuthorDate: Thu Jul 2 18:36:39 2015 +0000 Commit: Jason Zaman gentoo org> CommitDate: Thu Jul 2 18:36:39 2015 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=5e553876 qemu: add policy for qemu-guest-agent policy/modules/contrib/qemu.fc | 9 +++++++++ policy/modules/contrib/qemu.te | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+) diff --git a/policy/modules/contrib/qemu.fc b/policy/modules/contrib/qemu.fc index 86ea53c..f1304fb 100644 --- a/policy/modules/contrib/qemu.fc +++ b/policy/modules/contrib/qemu.fc @@ -4,3 +4,12 @@ /usr/bin/kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) /usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0) + +ifdef(`distro_gentoo',` +/usr/bin/qemu-ga -- gen_context(system_u:object_r:qemu_ga_exec_t,s0) + +/var/log/qemu-ga.log -- gen_context(system_u:object_r:qemu_ga_log_t,s0) +/var/log/qemu-ga(/.*)? -- gen_context(system_u:object_r:qemu_ga_log_t,s0) + +/var/run/qemu-ga.pid -- gen_context(system_u:object_r:qemu_ga_run_t,s0) +') diff --git a/policy/modules/contrib/qemu.te b/policy/modules/contrib/qemu.te index cf647bb..73dd715 100644 --- a/policy/modules/contrib/qemu.te +++ b/policy/modules/contrib/qemu.te @@ -77,4 +77,39 @@ ifdef(`distro_gentoo',` optional_policy(` vde_connect(qemu_t) ') + + ################################# + # + # QEMU Guest Agent policy + # + type qemu_ga_t; + type qemu_ga_exec_t; + init_system_domain(qemu_ga_t, qemu_ga_exec_t) + + type qemu_ga_log_t; + logging_log_file(qemu_ga_log_t) + + type qemu_ga_run_t; + files_pid_file(qemu_ga_run_t) + + allow qemu_ga_t self:capability sys_admin; + allow qemu_ga_t self:unix_dgram_socket create connect; + + manage_dirs_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + append_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + create_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + setattr_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + logging_log_filetrans(qemu_ga_t, qemu_ga_log_t, { dir file }) + + allow qemu_ga_t qemu_ga_run_t:file manage_file_perms; + files_pid_filetrans(qemu_ga_t, qemu_ga_run_t, file) + + corecmd_exec_bin(qemu_ga_t) + corecmd_exec_shell(qemu_ga_t) + + miscfiles_read_localization(qemu_ga_t) + + userdom_use_user_terminals(qemu_ga_t) + + term_use_virtio_console(qemu_ga_t) ')