From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 4FBB1138D18 for ; Mon, 13 Jul 2015 21:46:01 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 0A05DE0934; Mon, 13 Jul 2015 21:45:56 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 53D49E0922 for ; Mon, 13 Jul 2015 21:45:55 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 854C9340942 for ; Mon, 13 Jul 2015 21:45:54 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id EA3539A4 for ; Mon, 13 Jul 2015 21:45:51 +0000 (UTC) From: "Jason Zaman" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Jason Zaman" Message-ID: <1436823814.fc4534a206e1c2508a77c087cb55212a0ecf1882.perfinion@gentoo> Subject: [gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/contrib/ X-VCS-Repository: proj/hardened-refpolicy X-VCS-Files: policy/modules/contrib/qemu.fc policy/modules/contrib/qemu.te X-VCS-Directories: policy/modules/contrib/ X-VCS-Committer: perfinion X-VCS-Committer-Name: Jason Zaman X-VCS-Revision: fc4534a206e1c2508a77c087cb55212a0ecf1882 X-VCS-Branch: next Date: Mon, 13 Jul 2015 21:45:51 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 0b268803-7263-43e5-b4ef-73b78e4fc486 X-Archives-Hash: 1968bffc45ac5c91b0a22b99317a770b commit: fc4534a206e1c2508a77c087cb55212a0ecf1882 Author: Jason Zaman perfinion com> AuthorDate: Thu Jul 2 18:36:39 2015 +0000 Commit: Jason Zaman gentoo org> CommitDate: Mon Jul 13 21:43:34 2015 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=fc4534a2 qemu: add policy for qemu-guest-agent policy/modules/contrib/qemu.fc | 9 +++++++++ policy/modules/contrib/qemu.te | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+) diff --git a/policy/modules/contrib/qemu.fc b/policy/modules/contrib/qemu.fc index 86ea53c..f1304fb 100644 --- a/policy/modules/contrib/qemu.fc +++ b/policy/modules/contrib/qemu.fc @@ -4,3 +4,12 @@ /usr/bin/kvm -- gen_context(system_u:object_r:qemu_exec_t,s0) /usr/libexec/qemu.* -- gen_context(system_u:object_r:qemu_exec_t,s0) + +ifdef(`distro_gentoo',` +/usr/bin/qemu-ga -- gen_context(system_u:object_r:qemu_ga_exec_t,s0) + +/var/log/qemu-ga.log -- gen_context(system_u:object_r:qemu_ga_log_t,s0) +/var/log/qemu-ga(/.*)? -- gen_context(system_u:object_r:qemu_ga_log_t,s0) + +/var/run/qemu-ga.pid -- gen_context(system_u:object_r:qemu_ga_run_t,s0) +') diff --git a/policy/modules/contrib/qemu.te b/policy/modules/contrib/qemu.te index cf647bb..136f6f3 100644 --- a/policy/modules/contrib/qemu.te +++ b/policy/modules/contrib/qemu.te @@ -77,4 +77,39 @@ ifdef(`distro_gentoo',` optional_policy(` vde_connect(qemu_t) ') + + ################################# + # + # QEMU Guest Agent policy + # + type qemu_ga_t; + type qemu_ga_exec_t; + init_system_domain(qemu_ga_t, qemu_ga_exec_t) + + type qemu_ga_log_t; + logging_log_file(qemu_ga_log_t) + + type qemu_ga_run_t; + files_pid_file(qemu_ga_run_t) + + allow qemu_ga_t self:capability sys_admin; + allow qemu_ga_t self:unix_dgram_socket create_socket_perms; + + manage_dirs_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + append_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + create_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + setattr_files_pattern(qemu_ga_t, qemu_ga_log_t, qemu_ga_log_t) + logging_log_filetrans(qemu_ga_t, qemu_ga_log_t, { dir file }) + + allow qemu_ga_t qemu_ga_run_t:file manage_file_perms; + files_pid_filetrans(qemu_ga_t, qemu_ga_run_t, file) + + corecmd_exec_bin(qemu_ga_t) + corecmd_exec_shell(qemu_ga_t) + + miscfiles_read_localization(qemu_ga_t) + + userdom_use_user_terminals(qemu_ga_t) + + term_use_virtio_console(qemu_ga_t) ')