From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 49975138D03 for ; Sat, 11 Jul 2015 19:52:49 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 24424E08CE; Sat, 11 Jul 2015 19:52:47 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 3C645E08DC for ; Sat, 11 Jul 2015 19:52:46 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 4C326340884 for ; Sat, 11 Jul 2015 19:52:45 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id B8A6B75E for ; Sat, 11 Jul 2015 19:52:42 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1436606944.c28c751821b9d75b38f0c89a070be2de09a26604.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/qemu.fc policy/modules/contrib/qemu.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: c28c751821b9d75b38f0c89a070be2de09a26604 X-VCS-Branch: next Date: Sat, 11 Jul 2015 19:52:42 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: cc95e9fc-711a-49df-80ac-bd72ddf5d7f8 X-Archives-Hash: 77cf0ee31564069153e64ea8aeec3ed1 commit: c28c751821b9d75b38f0c89a070be2de09a26604 Author: Jason Zaman perfinion com> AuthorDate: Thu Jul 2 18:36:39 2015 +0000 Commit: Jason Zaman gentoo org> CommitDate: Sat Jul 11 09:29:04 2015 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c28c7518 qemu: add policy for qemu-guest-agent policy/modules/contrib/qemu.fc | 9 +++++++++ policy/modules/contrib/qemu.te | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+) diff --git a/policy/modules/contrib/qemu.fc b/policy/modules/contrib/qemu.fc index 86ea53c..f1304fb 100644 --- a/policy/modules/contrib/qemu.fc +++ b/policy/modules/contrib/qemu.fc @@ -4,3 +4,12 @@ /usr/bin/kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) /usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0) + +ifdef(`distro_gentoo',` +/usr/bin/qemu-ga -- gen_context(system_u:object_r:qemu_ga_exec_t,s0) + +/var/log/qemu-ga.log -- gen_context(system_u:object_r:qemu_ga_log_t,s0) +/var/log/qemu-ga(/.*)? -- gen_context(system_u:object_r:qemu_ga_log_t,s0) + +/var/run/qemu-ga.pid -- gen_context(system_u:object_r:qemu_ga_run_t,s0) +') diff --git a/policy/modules/contrib/qemu.te b/policy/modules/contrib/qemu.te index cf647bb..136f6f3 100644 --- a/policy/modules/contrib/qemu.te +++ b/policy/modules/contrib/qemu.te @@ -77,4 +77,39 @@ ifdef(`distro_gentoo',` optional_policy(` vde_connect(qemu_t) ') + + ################################# + # + # QEMU Guest Agent policy + # + type qemu_ga_t; + type qemu_ga_exec_t; + init_system_domain(qemu_ga_t, qemu_ga_exec_t) + + type qemu_ga_log_t; + logging_log_file(qemu_ga_log_t) + + type qemu_ga_run_t; + files_pid_file(qemu_ga_run_t) + + allow qemu_ga_t self:capability sys_admin; + allow qemu_ga_t self:unix_dgram_socket create_socket_perms; + + manage_dirs_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + append_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + create_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + setattr_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + logging_log_filetrans(qemu_ga_t, qemu_ga_log_t, { dir file }) + + allow qemu_ga_t qemu_ga_run_t:file manage_file_perms; + files_pid_filetrans(qemu_ga_t, qemu_ga_run_t, file) + + corecmd_exec_bin(qemu_ga_t) + corecmd_exec_shell(qemu_ga_t) + + miscfiles_read_localization(qemu_ga_t) + + userdom_use_user_terminals(qemu_ga_t) + + term_use_virtio_console(qemu_ga_t) ')