From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 5A8F0138CD0 for ; Thu, 2 Jul 2015 19:28:51 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id DC2C2E079D; Thu, 2 Jul 2015 19:28:45 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 86E8CE079D for ; Thu, 2 Jul 2015 19:28:45 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id AB121340955 for ; Thu, 2 Jul 2015 19:28:44 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id D0B4C739 for ; Thu, 2 Jul 2015 19:28:42 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1435865298.cb74ab5588b3c5b8575ca0a8ba933dc52f7c249a.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/qemu.fc policy/modules/contrib/qemu.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: cb74ab5588b3c5b8575ca0a8ba933dc52f7c249a X-VCS-Branch: next Date: Thu, 2 Jul 2015 19:28:42 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 89b306fe-119e-4f66-bdf9-14280960b0a8 X-Archives-Hash: d968e62bbb96e0f9cc81415ad76a51a9 commit: cb74ab5588b3c5b8575ca0a8ba933dc52f7c249a Author: Jason Zaman perfinion com> AuthorDate: Thu Jul 2 18:36:39 2015 +0000 Commit: Jason Zaman gentoo org> CommitDate: Thu Jul 2 19:28:18 2015 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=cb74ab55 qemu: add policy for qemu-guest-agent policy/modules/contrib/qemu.fc | 9 +++++++++ policy/modules/contrib/qemu.te | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+) diff --git a/policy/modules/contrib/qemu.fc b/policy/modules/contrib/qemu.fc index 86ea53c..f1304fb 100644 --- a/policy/modules/contrib/qemu.fc +++ b/policy/modules/contrib/qemu.fc @@ -4,3 +4,12 @@ /usr/bin/kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) /usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0) + +ifdef(`distro_gentoo',` +/usr/bin/qemu-ga -- gen_context(system_u:object_r:qemu_ga_exec_t,s0) + +/var/log/qemu-ga.log -- gen_context(system_u:object_r:qemu_ga_log_t,s0) +/var/log/qemu-ga(/.*)? -- gen_context(system_u:object_r:qemu_ga_log_t,s0) + +/var/run/qemu-ga.pid -- gen_context(system_u:object_r:qemu_ga_run_t,s0) +') diff --git a/policy/modules/contrib/qemu.te b/policy/modules/contrib/qemu.te index cf647bb..136f6f3 100644 --- a/policy/modules/contrib/qemu.te +++ b/policy/modules/contrib/qemu.te @@ -77,4 +77,39 @@ ifdef(`distro_gentoo',` optional_policy(` vde_connect(qemu_t) ') + + ################################# + # + # QEMU Guest Agent policy + # + type qemu_ga_t; + type qemu_ga_exec_t; + init_system_domain(qemu_ga_t, qemu_ga_exec_t) + + type qemu_ga_log_t; + logging_log_file(qemu_ga_log_t) + + type qemu_ga_run_t; + files_pid_file(qemu_ga_run_t) + + allow qemu_ga_t self:capability sys_admin; + allow qemu_ga_t self:unix_dgram_socket create_socket_perms; + + manage_dirs_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + append_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + create_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + setattr_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + logging_log_filetrans(qemu_ga_t, qemu_ga_log_t, { dir file }) + + allow qemu_ga_t qemu_ga_run_t:file manage_file_perms; + files_pid_filetrans(qemu_ga_t, qemu_ga_run_t, file) + + corecmd_exec_bin(qemu_ga_t) + corecmd_exec_shell(qemu_ga_t) + + miscfiles_read_localization(qemu_ga_t) + + userdom_use_user_terminals(qemu_ga_t) + + term_use_virtio_console(qemu_ga_t) ')